Caterpillar Global Data Privacy Statement

This Privacy Statement applies to the Caterpillar subsidiaries, affiliates, and other entities controlled by Caterpillar Inc. as are identified in Schedule A (List of Caterpillar Data Controllers / Legal Entities) (collectively, “Caterpillar”). This Privacy Statement applies only when Caterpillar is collecting or otherwise processing personal information for Caterpillar’s purposes (i.e., when Caterpillar (either alone or in common with other entities) is a controller and therefore determines the purposes for which and the manner in which any personal information is processed). This Privacy Statement does not apply when Caterpillar is collecting or otherwise processing personal information on behalf of another company, such as Caterpillar’s dealers, suppliers, and customers.

The applicable Caterpillar entity that is the “controller” of your data is the one with which you have a relationship, including for example: as a customer (e.g., the Caterpillar company referred to in your purchase order or other agreement with Caterpillar), an employee (e.g., the Caterpillar company that you are attempting to or have entered into a relationship with), or a supplier (e.g., the Caterpillar company that you are attempting to or have entered into a supplier relationship with). Caterpillar encourages the periodic review of this Privacy Statement to stay aware of any changes it.

For convenience, in several sections this Privacy Statement is organized by the category of data subjects identified below. Please note that in some situations, you may not fit perfectly into any one category (for example, more than one could apply, or you might not be a customer of Caterpillar, yet the customer section is the most applicable). Please review all of the language that is appropriate to your relationship with Caterpillar. This Privacy Statement covers the personal information of individuals who are:

• Caterpillar candidates for employment or employees (meaning staff, personnel, and workers) or other persons currently or formerly employed to perform work for Caterpillar, including temporary employees (collectively, “employees”);
• Associated with Caterpillar’s customers, including dealers, dealers’ customers, distributors, distributors’ customers, direct sale customers, sales representatives and other resellers (collectively, “customers”); and
• Associated with suppliers of Caterpillar, such as suppliers’ employees (temporary workers, staff, personnel, and contractors, etc.) (collectively, “suppliers”).

In this Privacy Statement, the term “processing” means any activity performed on personal information, including, for example, collecting, storing, modifying, transferring or otherwise using it. Additionally, this Privacy Statement does not apply to other information (non-Personal Information) that Caterpillar may collect or otherwise process. For more information on other information that Caterpillar may collect or otherwise process, please see Caterpillar’s Data Governance Statement.

In addition to this Privacy Statement, some Caterpillar systems, applications, and processes may contain their own privacy notices, which provide additional details about what specific personal information is collected and how it is stored, used, and transferred.

Certain jurisdictions may prohibit or limit the collection, use or sharing of specific categories of personal information; accordingly, this Privacy Statement describing our practices may be limited by those laws and/or further clarified in any country-specific appendices applicable to you and attached to this Privacy Statement. When in conflict with this Privacy Statement, those appendices control.

For purposes of this Privacy Statement, personal information is any information about a specific individual or that identifies or may identify a specific individual. In other words, it is any piece of information than can be linked to you. Certain jurisdictions may prohibit or limit the collection of specific categories of personal information. Subject to local law and any attached appendices, examples of personal information that we may collect include, but are not limited to:

• Contact Information (e.g., name, address, telephone number, emergency contact(s) information);
• Social Security Number or other national/taxpayer identification numbers;
• Identification and Verification Information (e.g., photographs, driver’s license, passport, other proofs of identity);
• Information Security Data (e.g., communications created, stored or transmitted by a person using Caterpillar’s information technology or communications equipment);
• Information to fulfill items such as, but not limited to, communications, contracts, purchase orders, payments, and receivables; and
• Other information required to comply with applicable laws, including valid search warrants, subpoenas, or court orders.

Different categories of persons may be subject to additional collection of personal information, including but not limited to:

Customers:

• Business Contact Information (e.g., company name, address, telephone number);
• Individual Representative Contact Information: (e.g., name, address, telephone number, email address);
• Billing Information (e.g., financial account data, invoices, receipts);
• Client Relationship Management Information (e.g., information necessary to populate a customer’s profile or to facilitate marketing automation);
• Repair Information (e.g., repair needs and status);
• Warranty Information (e.g., purchase history, extended warranties); and
• Customer Satisfaction Information.

Caterpillar may receive equipment information that is personally identifiable by another party, e.g., the equipment owner, but in most instances, Caterpillar will not be the controller of that information.

Employees:

• Background Information (e.g., birth date, marital status, dependent information, ethnicity and/or nationality);
• Residency Information (e.g., work permit status);
• Financial Account Information;
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues);
• Background Check Information (e.g., credit and criminal background checks, drug and alcohol testing);
• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims);
• Biometric Information (e.g., thumbprints);
• Trade Union affiliation;
• Automotive Information (e.g., driving history, vehicle registration, driver’s license number);
• Professional Qualifications Information (e.g., work experience, education); and
• Employment-related Information (e.g., work history, new hire forms, skills, education and training, performance appraisals, goals, attendance, work absences, vacation entitlement and requests, compensation history, workplace injury and illness reporting, disciplinary issues, and grievances).

Suppliers:

• Residency Information (e.g., work permit status);
• Financial Account Information;
• Background Information (e.g. due diligence)
• Professional Qualifications Information (e.g., work experience, education);
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues); and
• Biometric Information (e.g., thumbprints).

Depending on the applicable local law, some personal information collected by Caterpillar may be considered “sensitive personal information” (i.e., personal information subject to additional protections).

Additionally, in some cases, such as where you are the sole proprietor of a business, information about your company may be deemed personal information. This could include business information (e.g., office address), financial account information (e.g., bank account information, trade references, financial statements), assets (e.g., property ownership), credit rating, tax identification, and diversity classification.

Caterpillar may use anonymized (or de-identified information), that was derived from personal information, but in its anonymized form cannot be identified with a specific individual. This de-identified information is not considered personal information for purposes of this Privacy Statement and is not covered by this Privacy Statement. However, if such information is used or formatted in such a way that it is possible for that information to be identified with a specific individual, then it will be considered personal information as appropriate.

Caterpillar collects personal information in a variety of contexts from different categories of persons.

Customers (either directly or, in some cases, through third parties) can provide personal information through the business relationship involved in acquiring, marketing, or selling Caterpillar products or services. This includes, for example, submission of personal information as part of a proposal, a contract, receiving and employing services or products (including repair and warranty services), and potentially accessing Caterpillar systems or monitoring Caterpillar processes. Throughout the duration of a customer relationship, Caterpillar reserves the right to request, as needed, other forms of personal information necessary to facilitate the purposes described below.

Employees can provide personal information directly during the application and on-boarding process, throughout the duration of employment, and, in some cases where permitted, upon separation. In addition, Caterpillar may collect the information described above from a third party, for example, when we contact references that were provided to Caterpillar by an employee, or when we obtain background check information in accordance with our policies and applicable laws in connection with an employee’s application or on-boarding process. Much of this information is voluntarily provided to Caterpillar as a condition of employment to facilitate Caterpillar’s management of the employer-employee relationship, which is vital to our collective success.

Suppliers can provide personal information through the business relationship involved in acquiring, marketing, or selling Caterpillar products or services. This includes, for example, submission of personal information as part of a proposal, a contract, delivering services or products, and potentially accessing Caterpillar systems or monitoring Caterpillar processes. Throughout the duration of a supplier relationship, Caterpillar reserves the right to request, as needed, other forms of personal information necessary to facilitate the purposes described below.

Additionally, for individuals who go to a Caterpillar facility or location, photographs or video may be captured (e.g., closed circuit television cameras or CCTV).

Caterpillar processes your personal information where it is permitted to do so under applicable data protection laws, including for the purposes of its legitimate interests, to comply with a legal obligation of Caterpillar, and where you have consented for Caterpillar to do so.

In some cases, your consent to the collection of your personal information may be provided in a manner appropriate to the context, meaning it can be provided orally, in writing, electronically, or—when permitted by local laws—it may be implied where the purpose is apparent from the circumstances and you voluntarily provide your personal information. Subject to local laws, and as may be articulated in the attached country-specific appendices, there may be circumstances under which Caterpillar must obtain explicit consent from you. Such consent is your choice and is entirely voluntary. In some circumstances, you may withdraw your consent to Caterpillar’s collection and use of personal information subject to contractual and legal restrictions and reasonable notice.

Caterpillar uses personal information in ways that are compatible with the purposes for which the information was originally collected. This may include use for a purpose that is reasonably related to the original purpose of collection. Caterpillar collects, uses, and discloses personal information as an essential part of operations.

Additional information describing how we use this personal information may be provided in the supplemental appendices that describe unique legal obligations and rights available in different jurisdictions.

Personal information may also be processed in order to meet legal requirements applicable to Caterpillar, such as filing with government agencies, complying with lawful orders to provide information, meeting contractual commitments, and in connection with Caterpillar safeguarding its rights and property.

Personal information is vital to our management and administration of customer, employment, and supplier relationships generally. Subject to local law and any attached appendices, personal information is collected from different categories of persons for different purposes. Below, we describe the different purposes for collecting personal information from customers, suppliers, and employees.

Customer Personal Information Collection Purposes

Caterpillar uses customer personal information to conduct business operations (e.g., satisfy customer orders), market new products through individual outreach or group communications (e.g., newsletters), assess internal performance, manage customer relationships, (e.g., invoicing and payments), manage risk and compliance, and support various administrative functions. Some examples of personal information Caterpillar may collect from customers and accompanying uses include:

Employee Personal Information Collection Purposes

Caterpillar uses employee personal information to conduct business operations (e.g., managing access control, security systems, and updating personnel directories), foster employee development (e.g., Training), support various administrative functions (e.g., administering compensation plans, benefits, and leave schedules), and manage the operation of our businesses.

Some examples of personal information that Caterpillar may collect from employees and accompanying uses include:

Supplier Personal Information Collection Purposes

Caterpillar uses supplier personal information to conduct business operations (e.g., managing access control and security systems), select and approve new suppliers, assess supplier performance, manage supplier relationships, (e.g., invoicing, and payments), manage risk and compliance, and support various administrative functions.

Some examples of personal information Caterpillar may collect from suppliers and accompanying uses include:

Section 5. How does Caterpillar safeguard personal information?

Caterpillar utilizes reasonable measures, including information technology security and physical security measures, to protect personal information. These measures are appropriate to the risks posed by the processing of personal information and to the sensitivity of the personal information and take into account the requirements of applicable local law. Caterpillar requires all persons to abide by applicable security policies related to personal information when using Caterpillar systems.

Section 6. How long does Caterpillar keep personal information?

Caterpillar stores personal information as needed to accomplish the purposes identified above and to meet legal requirements, including record retention. Our retention of your personal information is at all times subject to local law. This storage period may extend beyond the term of your relationship with Caterpillar.

Section 7. How does Caterpillar dispose of personal information?

When personal information is no longer useful, or in any event, after legal authority to retain it has expired, personal information will be destroyed, in accordance with local law and pursuant to procedures established by the relevant Caterpillar system or process.

Because Caterpillar operates a global business, we may need to transfer your personal information to different jurisdictions for our business purposes. Caterpillar may transfer personal information to countries or jurisdictions that may not legally mandate the same level of data protection as the jurisdiction in which that personal information was collected. This Privacy Statement applies to all Caterpillar operations and their data processing activities and Caterpillar has entered into data transfer agreements with its affiliates worldwide to protect personal information.

Caterpillar only shares personal information with others in a manner consistent with this Privacy Statement, for the purposes stated above, when required by law, or with your consent. Information transfers to third parties will generally be transfers to third-party processors for those purposes consistent with this Privacy Statement. In addition, Caterpillar may transfer personal information to third-party data controllers as required by law, with your consent, or with approval from a relevant authority. In some jurisdictions, transfer of specifically delineated categories of data or transfer to certain third parties may require explicit consent from you. In all instances, the transfer of personal information is subject to local law and the attached appendices.

When Caterpillar shares personal information with third parties that process the personal information on Caterpillar’s behalf (e.g., contractors, consultants), Caterpillar takes reasonable steps to require such recipients to protect personal information in accordance with applicable laws. Examples of third parties with whom we may share information for any of these purposes include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies (when required by law; authorized by the customer; to protect Caterpillar, a person or property; and to support our business, such as in applications for government grants);
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar;
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business; and
• (Employees only) Vendors providing medical or financial planning services to employees.

Caterpillar takes steps to maintain the accuracy and completeness of personal information. You may request and will receive reasonable access to the personal information you have provided to Caterpillar and have an opportunity to correct it if necessary. Caterpillar procedures grant you access to your personal information and enable the exercise of other rights that may be available to you under applicable local law.

Unless prohibited by local law or, in some cases, as mandated by local law, your right to access your personal information may be limited. Examples for why your access may be limited include:

• The request relates to legal advice and proceedings;
• A legal privilege may be claimed regarding the subject matter of the information;
• The personal information also includes the personal information of a third party who has not consented to disclosure and whose privacy would be affected by any such disclosure;
• The request is insufficiently detailed or has already been responded to; 
• The request is frivolous or vexatious; or
• (Employees only) The information could disclose a confidential reference.

Caterpillar will consider local laws when reviewing requests to access or alter personal information held by Caterpillar.

If you are a customer, please contact the person representing Caterpillar to whom you have given your personal information for the proper procedure for obtaining access to your personal information.

If you are an employee, please contact your local, regional or corporate Human Resources representative for the proper procedure for obtaining access to your personal information. Upon request, and after providing satisfactory proof of identity and any additional requirements established by applicable local law, you will be given access to your personal information that you have a right to review and, if appropriate, the option to copy, modify, delete, or contest that personal information in Caterpillar’s systems.

If you are a supplier, you may contact the individual at your organization who is responsible for the Caterpillar relationship and who maintains a Corporate Web Security Identification (CWS ID) and/or has access to the Supplier Data Management Application (e.g. Supplier Connect) for “self-service” access.

For more specific information regarding rights under the General Data Protection Regulations (“GDPR”); please see Appendix 1 and/or Appendix 2 as applicable.  For more specific information regarding rights under the California Consumer Privacy Act (CCPA); please see Appendix 4 of this document.

Section 10. Where can you obtain further information?

If you have any questions about this Privacy Statement, you may contact us by email at  dataprivacy@cat.com; by telephone at  +1 309-494-3282 (DATA); or by mail to the address listed below. If you believe your personal information has been handled in a manner inconsistent with this Privacy Statement you should not hesitate to reach out to dataprivacy@cat.com or Caterpillar’s Office of Business Practices at https://www.caterpillar.com/en/company/code-of-conduct/office-of-business-practices.html or by calling +1 (800) 300-7898 or the country specific phone number listed on the above referenced website.

Attn: Data Privacy Team
Caterpillar Inc.
100 NE Adams St.
Peoria, IL 61629

Additionally, contact information for your local Data Controller may also be provided in your purchase order or any other agreement you have with Caterpillar.

If you are an employee, you can receive more information through your local, regional or corporate Human Resources representative at:

Human Resources, 100 N.E. Adams Street, Peoria, IL 61629, USA
corporate_hr@cat.com

In some cases, contact information for your local Human Resources representative is included in your Employee Handbook or Agreement.

Section 11. What happens if this Privacy Statement changes?

We reserve the right to amend this Privacy Statement as needed. When we do, the changes will be communicated to affected persons at that time, and we will note near the top of this Privacy Statement the date that any such changes are made and/or when they become effective. In some instances, if the changes we make are material, we may also send you an e-mail message or other communication telling you about such changes and any choices you may have or actions you can take before they go into effect. Depending on the nature of the changes and subject to local law, your continued relationship with Caterpillar will demonstrate your acceptance of those changes.

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information (including special categories of personal information) in or from certain countries in the European Economic Area (“EEA”). This Appendix is applicable to individuals who do not have an employee / human resources relationship with Caterpillar. For more information please see Caterpillar’s Global Data Privacy Statement. For more information on how Caterpillar collects and processes non-personal information, please see Caterpillar’s Global Data Governance Statement.

If you were referred to this EEA Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this EEA Appendix, the relevant controllers are listed in the Schedule A (List of Caterpillar Data Controllers / Legal Entities) of the Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This EEA Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (“GDPR”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this EEA Appendix.

Section 2. What sensitive personal information could Caterpillar collect and process?

Sensitive personal information (also known as special categories of information) requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store and use the following, which may include or be considered “special categories” of information (as defined above):

• Background Information (e.g., marital status, dependent information, ethnicity and/or nationality, credit and criminal background checks, and drug and alcohol testing); and
• Biometric Information (e.g., thumbprints).

Section 3. Why does Caterpillar use your personal information?

We need all the categories of information collected primarily to allow us to manage our relationship with you in order to operate our business and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Non-Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary in order to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where it is necessary for the performance of a contract.
• We may also use your personal information in the following situations, which are likely to be rare:
• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).

The legal grounds we rely on to process your personal information are listed in Table 1.

Section 5. What are special categories of personal information used for at Caterpillar?

We will use your special categories of personal information for the following purposes:

• Information related to biometric data, to identify or authenticate users and for access control purposes.
• Background check information, to evaluate and select individuals with whom Caterpillar is working.

We may process special categories of personal information (as defined above) because we have a lawful basis for doing so (as set out above) and because in limited circumstances, we have your explicit written consent. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information in the course of legitimate business activities with the appropriate safeguards.

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under European data protection laws (and subject to the manner in which they and other laws and regulations apply to and must be complied with by Caterpillar), you have the right to object to automated decision making using your personal information.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. We also rely on consent in other situations as identified in Table 1.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing you with a product), or we may be prevented from complying with our legal or regulatory obligations.

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the EU?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside the EEA if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. Please contact your Caterpillar contact or email dataprivacy@cat.com for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate personal information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using one of the following methods:

Online: EU Individual Rights Request Form
Email:  dataprivacy@cat.com
Telephone:  +1 (800) 806-6832 or +1 309-494-3282(DATA)

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact dataprivacy@cat.com or use any unsubscribe options we may provide you in the context of our processing activities. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 1. Non-Human Resources Data Subjects EEA] 

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information (including special categories of personal information) in or from certain countries in the European Economic Area (“EEA”). This Appendix is applicable to individuals who have an employee / human resources relationship with Caterpillar. For more information, please see Caterpillar’s Global Privacy Statement.

If you were referred to this EEA Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this EEA Appendix, the relevant controllers are listed in the Schedule A (List of Caterpillar Data Controllers / Legal Entities) to Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This EEA Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (“GDPR”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this EEA Appendix.

Section 2. What sensitive personal information could Caterpillar collect and process?

Sensitive personal information (also known as special categories of information) requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store and use the following, which may include or be considered “special categories” of information (as defined above):

• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims) related to, among other things, physical or mental health, disability status, sickness absence, and family related leaves;
• Background Information (e.g., marital status, dependent information, ethnicity and/or nationality, credit and criminal background checks, and drug and alcohol testing);
• Biometric Information (e.g., thumbprints); and
• Trade Union affiliation.

Section 3. Why does Caterpillar use your personal information?

Personal information is vital to our management and administration of employment relationships. We need all the categories of personal information collected primarily to allow us to manage our relationship with you and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary for the performance of a contract we have entered into with you.
• Where it is necessary in order to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).

We will rely on legitimate interests as the lawful basis for processing the categories of personal information set out below and, in each case we have identified the legitimate interest upon which we rely. (We also identify supplemental bases for processing certain categories of information where warranted.)

Section 5. What are special categories of personal information used for at Caterpillar?

We will use your special categories of personal information for the following purposes:

• Information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
• Information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
• Information related to trade union affiliation to facilitate dues collection, maintain contact lists, and perform other business-related activities.
• Information related to ethnicity and/or nationality, to comply with employment and other laws.
• Information related to biometric data, to identify or authenticate users and for access control purposes.
• Information related to employment-related background checks, to evaluate and select individuals for a role within Caterpillar.

We may process special categories of personal information (as defined above) because we have a lawful basis for doing so (as set out above) and because:

• In limited circumstances, we have your explicit written consent;
• We need to carry out obligations or exercise specific rights in the field of employment and social security law and in line with our Global Data Privacy Statement;
• Where it is needed in the public interest, such as for equal opportunities monitoring and in line with our Global Data Privacy Statement; or
• Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information in the course of legitimate business activities with the appropriate safeguards.

Section 6. When is automated decision making used?

 Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under European data protection laws (and subject to the manner in which they and other laws and regulations apply to and must be complied with by Caterpillar), you have the right to object to automated decision making using your personal information.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal or regulatory obligations (such as ensuring your health and safety).

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third-party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons. Examples include:

• payroll;
• benefits provision and administration (including pensions);
• occupational health or medical assessments regarding your fitness to work and health and safety (e.g. workstation assessments);
• insurance claims and notifications;
• provision and administration of recruitment assessments, training and professional development;
• library and research services such as subscriptions and memberships;
• building security access and maintenance;
• travel providers;
• telecommunications and messaging services such as our business continuity emergency notification system;
• hard copy archiving; and
• IT services.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract, working relationship and any associated benefits with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the EU?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside the EEA if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy which is available from the HR department. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Once you are no longer an employee, worker or contractor of Caterpillar, we will retain and securely destroy your personal information in accordance with our data retention policy.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. Please contact your Human Resources representative for the proper procedure for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate personal information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using one of the following methods:

Online: EU Individual Rights Request Form
Email:  dataprivacy@cat.com
Telephone:  +1 (800) 806-6832 or +1 309-494-3282(DATA)

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please your local, regional or corporate Human Resources representative. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 2. Human Resources Data Subjects EEA]

Updated 07/01/2019

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information in or from Australia. For more information, please see the main body of Caterpillar’s Global Data Privacy Statement.

Section 1. Storage of Personal Information

Caterpillar stores personal information electronically on our servers, which are provided and managed by Caterpillar and its third-party vendors.

Section 2. Cross-border Transfers of Personal Information

We may disclose personal information outside of Australia, including to Caterpillar affiliates that are covered by this Global Data Privacy Statement and to vendors used by those Caterpillar companies (for a list of Caterpillar affiliates covered by Caterpillar’s Global Data Privacy Statement and the country in which they are established, see the Legal Entities Section of the Global Data Privacy Statement). The countries in which overseas recipients are likely to be located currently include the United States of America, the United Kingdom, the Netherlands, Switzerland, Singapore, China, Japan, and India. For personal information that is subject to the Australian Privacy Principles, we take appropriate steps to ensure an appropriate level of protection (e.g., consistent with the Australian Privacy Principles) when transferring such personal information to those in other countries or obtain your consent.

Section 3. Contacting Caterpillar or the Office of the Australian Information Commissioner

If you have any questions about Caterpillar’s processing of your personal information, please contact your local Caterpillar contact, Caterpillar’s Data Privacy Office at dataprivacy@cat.com, or Caterpillar’s Office of Business Practices as listed in Section 10 of the Global Data Privacy Statement. If you believe that personal information has been handled in a manner inconsistent with the Global Data Privacy Statement and you are not satisfied with the response provided by your local Caterpillar contact, the Privacy Office or Caterpillar’s Office of Business Practices you may wish to contact the Office of the Australian Information Commissioner.

Effective: January 1, 2020 (Last updated: May 1, 2020)

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information about California consumers (as defined by the California Consumer Privacy Act or “CCPA”). The CCPA, including its notice obligations and rights granted to individuals, applies differently to individuals in a Human Resources context (e.g., employees). Additionally, it includes exceptions for consumers that are engaged in business-to-business activities. Please refer to Article 1 – Human Resources of this Appendix 4 for more information in the Human Resources context. Please refer to Article 2 – Non-Human Resource Consumers of this Appendix 4 for more information about other consumers (excluding business-to-business activities exempted under the CCPA). For more information about Caterpillar’s practices about personal information more generally, please see the main body of Caterpillar’s Global Data Privacy Statement.

Article 1 – Human Resources

Section 1. What is the Purpose of this Article to Appendix 4?

The purpose of this Article to Appendix 4 is to inform job applicants, employees of, owners of, directors of, officers of, medical staff of, and contractors of Caterpillar (collectively referred to as "employees" for the purposes of this Article), of the categories of Personal Information (as defined below) that we collect and the purposes for which we use such Personal Information.

Section 2. Collection and Use of Personal Information for Business Purposes

For purposes of this Notice, “Personal Information” is information that relates to an identified or identifiable person. Personal Information does not include deidentified, aggregated, or combined information, which includes data that is not reasonably capable of identifying you or being linked to you. Personal Information also does not include publicly available information (information that is lawfully made available from federal, state, or local government records).

We collect, use, and disclose employee Personal Information for business purposes only (as described further below) and in a manner consistent with applicable laws. Where we disclose Personal Information to third parties, we do so for the same purposes described below and, where appropriate, we require that such third parties maintain the confidentiality of the Personal Information and maintain appropriate systems and processes to secure and protect the Personal Information.

We collect and use the following categories of Personal Information about you to manage your employment relationship with us:

Section 3. Additional Purposes for Using Personal Information

In addition to the purposes identified above, we may also use and share the categories of Personal Information identified above to:

• To audit interactions, transactions, and records;
• To monitor compliance with company policies and procedures;
• To detect security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
• To comply with legal obligations and to disclose to law enforcement or other government agencies (when required by law; to protect Caterpillar, a person or property; to support our business, such as in applications for government grants; and when authorized by you); and
• Otherwise disclose in accordance with directions, or consent, from you.

Section 4. Who can I Contact for Additional Information?

You can email Caterpillar’s Data Privacy team at: dataprivacy@Cat.com or through postal service at:

Attn: Data Privacy
Caterpillar Inc.
100 N.E. Adams Street
Peoria, IL 61629

Article 2 – Non-Human Resource Consumers

Section 1. What is the Purpose of this Article to Appendix 4?

The CCPA provides California consumers with certain rights regarding personal information about them. This Article describes how we collect, process, and disclose Personal Information about you during and after your relationship with us and explains your rights. If you are a California consumer and would like to exercise any of those rights under the CCPA, please see Section 5 below for more information on how to submit a request.

This Article applies only to California consumers. For the purpose of this Article, a “California consumer” is a natural person who resides in California and does not include persons to the extent they are (i) acting as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency that is doing business with Caterpillar (which includes our dealers) or (ii) acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of Caterpillar.

Section 2. What Categories of Personal Information Could Caterpillar Collect, Process, and Disclose and for what Purposes?

In addition to the purposes identified above, we may also use and share the categories of Personal Information identified above to:

• Disclose to law enforcement or other government agencies (when required by law; to protect Caterpillar, a person or property; to support our business, such as in applications for government grants; and when authorized by you)
• Otherwise disclose in accordance with directions from you

Section 3. Does Caterpillar Sell My Personal Information?

We have not sold your Personal Information in the preceding twelve (12) months and will not sell your Personal Information to third parties.

Section 4. What Rights Do I Have Under the CCPA?

You may have rights under the CCPA. The CCPA grants consumers certain rights with regard to Personal Information that relates to them; however, these rights are not absolute and in certain circumstances do not apply. The rights under the CCPA include:

• Right to Request Know / Access to Your Personal Information and Data Portability – The right to request information about the collection of your personal information by Caterpillar or access your personal information.
• Right to Deletion – The right to request the deletion of personal information about you.
• Right to Opt-Out of Sale of Personal Information – The right to direct the business to not sell (or stop selling) your personal information.
• Right of Non-Discrimination – The right to not be discriminated against for exercising your rights under the CCPA.
  
  We will not discriminate against you for exercising any of your rights under the CCPA, and unless permitted by the CCPA, we will not:
  • deny you goods or services;
  • charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
  • provide you a different level or quality of goods or services; or
  • suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services;

            for exercising one of your rights under the CCPA.

Section 5. How Do I Invoke a Right Under the CCPA?

You may exercise your right(s) under the CCPA by using one of the following methods: 

• Online:  CCPA Rights Request Intake Form;
• Email:  dataprivacy@cat.com; or
• Telephone:  +1 (800) 806-6832 or +1 309-494-3282(DATA).

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. 

Since we can only respond to a verified request, we may request information from you in order to confirm that you, or an authorized agent designated by you, are the one exercising your right as a consumer. We may request that you send your request through your account (if you have an account) or we may ask certain security questions to verify your identity before we respond to your request. You do not need to create an account with Caterpillar to exercise any of your individual rights (access, deletion, or opt-out of sale).

Section 6. Who can I Contact for Additional Information?

You can email Caterpillar’s Data Privacy team at: dataprivacy@Cat.com or through postal service at:

Attn: Data Privacy
Caterpillar Inc.
100 N.E. Adams Street
Peoria, IL 61629

[END Appendix 4. California Consumer Privacy Act]

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers, and otherwise processes personal information (including sensitive personal data) in or from Brazil. This Appendix is applicable to individuals who do not have an employee / human resources relationship with Caterpillar. For more information, please see Caterpillar’s Global Data Privacy Statement. For more information on how Caterpillar collects and processes non-personal information, please see Caterpillar’s Global Data Governance Statement.

If you were referred to this Brazil Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this Brazil Appendix, the relevant controllers are listed in the Schedule A - List of Caterpillar Data Controllers / Legal Entities of the Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This Brazil Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/18 - “LGPD”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this Brazil Appendix.

Section 2. What sensitive personal data could Caterpillar collect and process?

Sensitive personal data requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store, and use the following, which may include or be considered sensitive personal data (as defined above):

• Background Information, if and when permitted by applicable laws (e.g., ethnicity and drug and alcohol testing); and
• Biometric Information (e.g., thumbprints).

Section 3. Why does Caterpillar use your personal information?

We need all the categories of information collected primarily to allow us to manage our relationship with you in order to operate our business and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Non-Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where it is necessary for the performance of a contract.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your life or physical integrity (or someone else’s life or physical integrity).
• Where we need it for credit protection.
• Where it is necessary for the exercise of our rights in lawsuits, administrative proceedings, or arbitration.
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).
• For the protection of credit, including as provided for in relevant legislation.

The legal grounds we rely on to process your personal information are listed in Table 1.

Section 5. What are sensitive personal data used for at Caterpillar?

We will use your sensitive personal data for the following purposes:

• Information related to biometric data, to identify or authenticate users and for access control purposes.

We may process sensitive personal data (as defined above) because we have a lawful basis for doing so (including, without limitation, for compliance with a legal obligation, or to protect the security of the data subject, as set out above) and because in limited circumstances, we have your explicit written consent. Less commonly, we may process this type of information where it is needed in relation to legal claims or exercise of our rights, or where it is needed to protect your life or physical integrity (or someone else’s life or physical integrity).

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under LGPD, you have the right to request the review decisions taken solely on the basis of automated processing of personal data that affects your interests.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive personal data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. We also rely on consent in other situations as identified in Table 1.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us. If you give us your consent, you will be able to withdraw your consent at any time.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing you with a product), or we may be prevented from complying with our legal or regulatory obligations.

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers and Caterpillar.

We may transfer your personal information outside Brazil. If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates, and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of Brazil?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside Brazil. It may also be processed by staff operating outside Brazil who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under LGPD and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside Brazil if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. Please contact your Caterpillar contact or email dataprivacy@cat.com for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Confirm the existence of processing;
• Request access to your personal information (commonly known as a “data subject access request”), by means of a summary report or a detailed report. Under certain limited circumstances, you may be entitled to receive a copy of the personal information we hold about you.
• Request correction of incomplete, inaccurate, or outdated personal information we hold about you.
• Request the anonymization, blocking or deletion of unnecessary or excessive personal information about you, or personal information about you we process in noncompliance with the provisions of LGPD.
• Request the portability of the personal information we hold about you to another service or product provider, under specific circumstances.
• Request the deletion of your personal information that was processed based on your consent.
• Obtain information about public and private entities with which we have shared your personal information.
• Obtain information about the possibility of denying consent and the consequences of such denial, whenever we ask for your consent to process your personal information.
• Oppose to any data processing activity for which your consent was not required, if there is a breach of LGPD.
• Revoke your consent, whenever our processing of your personal information was based on your consent.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using one of the following methods:

Online: Brazil Individual Rights Request Form

Email:  dataprivacy@cat.com

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may refuse to comply with the request if your request for access is clearly unfounded or excessive.

You may also contact the applicable Data Protection Officer. To identify the Data Protection Officer for the applicable Caterpillar company, please see Schedule A - List of Caterpillar Data Controllers / Legal Entities.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact dataprivacy@cat.com or use any unsubscribe options we may provide you in the context of our processing activities. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 5. Brazil - Non-Human Resources Data Subjects] 

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers, and otherwise processes personal information (including sensitive personal data) in or from Brazil. This Appendix is applicable to individuals who have an employee / human resources relationship with Caterpillar. For more information, please see Caterpillar’s Global Privacy Statement.

If you were referred to this Brazil Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this Brazil Appendix, the relevant controllers are listed in the Schedule A (List of Caterpillar Data Controllers / Legal Entities) to Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This Brazil Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/18 - “LGPD”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this Brazil Appendix.

Section 2. What sensitive personal data could Caterpillar collect and process?

Sensitive personal data (also known as special categories of information) requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store, and use the following, which may include or be considered sensitive personal data (as defined above):

• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims) related to, among other things, physical or mental health, disability status, sickness absence, and family related leaves;
• Background Information, if and when permitted by applicable laws (e.g., marital status, race, ethnicity, and drug and alcohol testing);
• Biometric Information (e.g., thumbprints); and
• Trade Union affiliation.

Section 3. Why does Caterpillar use your personal information?

Personal information is vital to our management and administration of employment relationships. We need all the categories of personal information collected primarily to allow us to manage our relationship with you and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary for the performance of a contract we have entered into with you.
• Where it is necessary to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your life or physical integrity (or someone else’s life or physical integrity).
• Where it is necessary for the exercise of our rights in lawsuits, administrative proceedings or arbitration
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).
• For the protection of credit, including as provided for in relevant legislation.

We will rely on legitimate interests as the lawful basis for processing the categories of personal information set out below and, in each case we have identified the legitimate interest upon which we rely. We also identify supplemental bases for processing certain categories of information where warranted in a specific notice that we will provide you.

Section 5. What are sensitive personal data used for at Caterpillar?

We will use your sensitive personal data for the following purposes:

• Information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
• Information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
• Information related to trade union affiliation to facilitate dues collection, maintain contact lists, and perform other business-related activities.
• Information related to ethnicity and/or nationality, to comply with employment and other laws.
• Information related to biometric data, to identify or authenticate users and for access control purposes.

We may process sensitive personal data (as defined above) because we have a lawful basis for doing so (as set out above) and because:

• In limited circumstances, we have your explicit written consent;
• We need to carry out obligations or exercise specific rights in the field of employment and social security law and in line with our Global Data Privacy Statement;

Less commonly, we may process this type of information where it is needed in relation to legal claims or exercise of our rights, or where it is needed to protect your life or physical integrity (or someone else’s life or physical integrity).

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under LGPD, you have the right to request the review of automated decision taken solely on the basis of automated processing of personal data that affects your interests.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive personal data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal or regulatory obligations (such as ensuring your health and safety).

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers, other Caterpillar entities, and public government agencies or authorities.

We may transfer your personal information outside Brazil. If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third-party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons. Examples include:

• payroll;
• benefits provision and administration (including pensions);
• occupational health or medical assessments regarding your fitness to work and health and safety (e.g. workstation assessments);
• insurance claims and notifications;
• provision and administration of recruitment assessments, training and professional development;
• library and research services such as subscriptions and memberships;
• building security access and maintenance;
• travel providers;
• telecommunications and messaging services such as our business continuity emergency notification system;
• hard copy archiving; and
• IT services.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract, working relationship and any associated benefits with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of Brazil?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside Brazil. It may also be processed by staff operating outside Brazil who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under LGPD and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside Brazil if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy which is available from the HR department. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Once you are no longer an employee, worker, or contractor of Caterpillar, we will retain and securely destroy your personal information in accordance with our data retention policy.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. In many cases, you have self-service access to your data (e.g., internal HR systems). Please keep your information up-to-date, or contact your Human Resources representative for the proper procedure for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Confirm the existence of processing;
• Request access to your personal information (commonly known as a “data subject access request”), by means of a summary report or a detailed report. Under certain limited circumstances, you may be entitled to receive a copy of the personal information we hold about you.
• Request correction of incomplete, inaccurate or outdated personal information we hold about you.
• Request the anonymization, blocking or deletion of unnecessary or excessive personal information about you, or personal information about you we process in noncompliance with the provisions of LGPD.
• Request the portability of the personal information we hold about you to another service or product provider, under specific circumstances.
• Obtain information about public and private entities with which we have shared your personal information.
• Oppose to any data processing activity for which your consent was not required if there is a breach of LGPD.
• Request the deletion of your personal information that was processed based on your consent.
• Obtain information about the possibility of denying consent and the consequences of such denial, whenever we ask for your consent to process your personal information.
• Revoke your consent, whenever our processing of your personal information was based on your consent.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using one of the following methods:

Online: Brazil Individual Rights Request Form

Email:  dataprivacy@cat.com

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may refuse to comply with the request if your request for access is clearly unfounded or excessive.

You may also contact the applicable Data Protection Officer. To identify the Data Protection Officer for the applicable Caterpillar company, please see Schedule A (List of Caterpillar Data Controllers / Legal Entities).

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the limited circumstances where you may have provided your consent to the collection, processing, and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact your local, regional, or corporate Human Resources representative. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 6. Brazil - Human Resources Data Subjects]

Effective: November 1, 2021

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers, and otherwise processes personal information (including sensitive personal information) in or from China as a Personal Information Handler (as defined by China’s Personal Information Protection Act or “PIPL”).  For more information, please see the main body of Caterpillar’s Global Data Privacy Statement. For more information on how Caterpillar collects and processes non-personal information, please see Caterpillar’s Global Data Governance Statement.

Section 1. Identity and Contact of the Personal Information Handler

If you were referred to this China Appendix from an agreement you have with Caterpillar, then the Personal Information Handler for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this China Appendix, the identity and contact of the relevant Personal Information Handler (also referred to in the Global Data Privacy Statement as a “Controller”) are listed in the Schedule A (List of Caterpillar Data Controllers / Legal Entities) to Caterpillar’s Global Privacy Statement. 

Section 2. Categories of Personal Information; Purposes and Handling Methods of Processing

We need all the categories of information collected primarily to allow us to manage our relationship with you in order to operate our business and to enable us to comply with our legal and regulatory obligations. The categories of personal information and the purposes for which we, or a contracted third party, will process your personal information are listed in Table 1 and Table 2 below. Some of those purposes for processing overlap and there may be several purposes which justify our use of your personal information.

Table 1 is applicable to individuals who do not have an employee / human resources relationship with Caterpillar. Table 2 is applicable to individuals who do have an employee / human resources relationship with Caterpillar.

Table 1. Categories of Personal Information; Purposes and Handling Methods of Processing: Non-Human Resources Data

If and when permitted by applicable laws, we may also process Financial Accounts Data, Health Data (e.g., symptoms of illness, vaccine and treatment information), and Biometric Information (e.g., fingerprints). This may constitute Sensitive Personal Information, defined under the PIPL as “personal information that, once leaked or illegally used, may easily cause harm to the dignity of natural persons or grave harm to personal or property security, including information on biometric characteristics, religious beliefs, specially-designated status, medical health, financial accounts, individual location tracking, etc., as well as the personal information of minors under the age of 14.”

·         Necessity: Processing may occur where it is necessary to:

o    Identify or authenticate users and for access control purposes;

o   Perform services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders or transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or similar services;

o   Manage health and safety at our facilities;

o   For reasons of public health; or

o   Comply with applicable laws.

·         Influence on your rights and interests: In order to respect your privacy rights and interests, we will only process Sensitive Personal Information where there is a specific purpose and a need to fulfill, and where strict protection measures have been implemented. To the extent your Sensitive Personal Data are processed by us, you will have the rights set forth in Section 4 of this Appendix and you may exercise such rights in accordance with Section 4.

In addition to the purposes identified above, we may also use and share the categories of Personal Information identified above to:

• Disclose to law enforcement or other government agencies (when required by law; to protect Caterpillar, a person or property; to support our business, such as in applications for government grants; and when authorized by you);
• When we have a lawful basis for doing so (including, without limitation, for compliance with a legal obligation, or to protect the security of the data subject), or where it is needed in relation to legal claims or exercise of our rights, or where it is needed to protect your life or physical integrity (or someone else’s life or physical integrity); or 
• Otherwise disclose in accordance with directions from you.

Table 2. Categories of Personal Information; Purposes and Handling Methods of Processing.: Human Resources Data

If and when permitted by applicable laws, we may also process sensitive personal information, as defined above. Sensitive personal information may be included within Health Information (e.g., prescription records, benefit claims, symptoms of illness, vaccine and treatment information, and the Explanation of Benefits sent in connection with claims) related to, among other things, physical or mental health, disability status, sickness absence, and family related leaves; Background Information, (e.g., marital status, race, ethnicity, and drug and alcohol testing); Financial Account Information (e.g., bank account information, payment records, tax records); and Biometric Information (e.g., fingerprints); and Trade Union affiliation.

·         Necessity: Processing may occur where it is necessary to achieve the specific purposes as described in this Statement, including:

o    To meet compliance and legal obligations, including employment-related obligations;

o    To ensure your health and safety in the workplace and to assess your fitness to work;

o    To facilitate benefits;

o    For reasons of public health;

o    To provide appropriate workplace adjustments, to monitor and manage and facilitate leaves of absence and to administer benefits;

o    To facilitate dues collection related to trade union membership, maintain contact lists, and perform other business-related activities related to trade union membership;

o    To identify or authenticate users and for access control purposes;

o    To carry out obligations or exercise specific rights in the field of employment and social security law and in line with our Global Data Privacy Statement; or

o    Where it is needed in relation to legal claims or exercise of our rights, or where it is needed to protect your life or physical integrity (or someone else’s life or physical integrity).

·         Influence on your rights and interests:  In order to respect your privacy rights and interests, we will only process Sensitive Personal Information where there is a specific purpose and a need to fulfill, and where strict protection measures have been implemented. To the extent your Sensitive Personal Data are processed by us, you will have the rights set forth in Section 4 of this Appendix and you may exercise such rights in accordance with Section 4.

Section 3. The Retention Period for Personal Information

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements, including Article 19 of the PIPL.

Section 4. Transfers of Personal Information

Where authorized, Caterpillar may transfer personal information outside of China. The countries in which overseas recipients are likely to be located currently include the United States of America, the United Kingdom, the Netherlands, Switzerland, Singapore, Japan, and India.

Where authorized, Caterpillar may transfer personal information to other Personal Information Handlers, including to Caterpillar affiliates that are covered by this Global Data Privacy Statement and to dealers engaged with those Caterpillar companies. For a list of Caterpillar affiliates covered by Caterpillar’s Global Data Privacy Statement and the countries or regions in which they are established, see Schedule A (List of Caterpillar Data Controllers / Legal Entities of the Global Data Privacy Statement.

In the event that you are interacting with a Caterpillar company that is performing a cross-border transfer of your personal information to a jurisdiction outside of China and/or performing a transfer of your personal information to another Personal Information Handler, we will protect such information as described in this Statement and as disclosed to you at the time of data collection or as described in our process-specific privacy notice, if applicable.

Section 5. Methods and Procedures for Individuals to Exercise their Rights

Under certain circumstances, by law you (or in limited situations, your next of kin) have the right to:

·         To know and decide relating to your personal information;

·         To limit or refuse the handling of personal information by others;

·         To access and obtain your personal information;

·         To request the transfer of your personal information to another Personal Information Handler;

·         To correct your personal information;

·         To request deletion of your personal information; or

·         To an explanation of the personal information handling rules.

If you want to exercise your right(s) as reflected above, you may do so by using one of the following methods:

·         Online: PRC Individual Rights Request Form; or

·         Email:  dataprivacy@cat.com

If submitting by email; please be sure to include what right(s) you are seeking to invoke and provide what data or information your request is concerning so that your request can be properly and timely addressed. If you are not satisfied with the response, you receive and have supplementary justification to support your request, you may escalate this to Caterpillar's Data Privacy Legal Team, in which case your request will undergo an additional review. You may also lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

[END Appendix 7. China]