Caterpillar Global Data Privacy Statement

This Privacy Statement applies to the Caterpillar subsidiaries, affiliates, and other entities controlled by Caterpillar Inc. as are identified in Schedule A (List of Caterpillar Data Controllers) (collectively, “Caterpillar”). This Privacy Statement applies only when Caterpillar is collecting or otherwise processing personal information for Caterpillar’s purposes (i.e., when Caterpillar (either alone or in common with other entities) is a controller and therefore determines the purposes for which and the manner in which any personal information is processed). This Privacy Statement does not apply when Caterpillar is collecting or otherwise processing personal information on behalf of another company, such as Caterpillar’s dealers, suppliers, and customers.

The applicable Caterpillar entity that is the “controller” of your data is the one with which you have a relationship, including for example: as a customer (e.g., the Caterpillar company referred to in your purchase order or other agreement with Caterpillar), an employee (e.g., the Caterpillar company that you are attempting to or have entered into a relationship with), or a supplier (e.g., the Caterpillar company that you are attempting to or have entered into a supplier relationship with). Caterpillar encourages the periodic review of this Privacy Statement to stay aware of any changes to it.

For convenience, in several sections this Privacy Statement is organized by the category of data subjects identified below. Please note that in some situations, you may not fit perfectly into any one category (for example, more than one could apply, or you might not be a customer of Caterpillar yet the customer section is the most applicable). Please review all of the language that is appropriate to your relationship with Caterpillar. This Privacy Statement covers the personal information of individuals who are:

• Caterpillar candidates for employment or employees (meaning staff, personnel, and workers) or other persons currently or formerly employed to perform work for Caterpillar, including temporary employees (collectively, “employees”);
• Associated with Caterpillar’s customers, including dealers, dealers’ customers, distributors, distributors’ customers, direct sale customers, sales representatives and other resellers (collectively, “customers”); and
• Associated with suppliers of Caterpillar, such as suppliers’ employees (temporary workers, staff, personnel, and contractors, etc.) (collectively, “suppliers”).

In this Privacy Statement, the term “processing” means any activity performed on personal information, including, for example, collecting, storing, modifying, transferring or otherwise using it. Additionally, this Privacy Statement does not apply to other information (non-Personal Information) that Caterpillar may collect or otherwise process. For more information on other information that Caterpillar may collect or otherwise process, please see Caterpillar’s Data Governance Statement.

In addition to this Privacy Statement, some Caterpillar systems, applications, and processes may contain their own privacy notices, which provide additional details about what specific personal information is collected and how it is stored, used, and transferred.

Certain jurisdictions may prohibit or limit the collection, use or sharing of specific categories of personal information; accordingly, this Privacy Statement describing our practices may be limited by those laws and/or further clarified in any country-specific appendices applicable to you and attached to this Privacy Statement. When in conflict with this Privacy Statement, those appendices control.

For purposes of this Privacy Statement, personal information is any information about a specific individual or that identifies or may identify a specific individual. In other words, it is any piece of information than can be linked to you. Certain jurisdictions may prohibit or limit the collection of specific categories of personal information. Subject to local law and any attached appendices, examples of personal information that we may collect include, but are not limited to:

• Contact Information (e.g., name, address, telephone number, emergency contact(s) information);
• Social Security Number or other national/taxpayer identification numbers;
• Identification and Verification Information (e.g., photographs, driver’s license, passport, other proofs of identity);
• Information Security Data (e.g., communications created, stored or transmitted by a person using Caterpillar’s information technology or communications equipment);
• Information to fulfill items such as, but not limited to, communications, contracts, purchase orders, payments, and receivables; and
• Other information required to comply with applicable laws, including valid search warrants, subpoenas, or court orders.

Different categories of persons may be subject to additional collection of personal information, including but not limited to:

Customers:

• Business Contact Information (e.g., company name, address, telephone number);
• Individual Representative Contact Information: (e.g., name, address, telephone number, email address);
• Billing Information (e.g., financial account data, invoices, receipts);
• Client Relationship Management Information (e.g., information necessary to populate a customer’s profile or to facilitate marketing automation);
• Repair Information (e.g., repair needs and status);
• Warranty Information (e.g., purchase history, extended warranties); and
• Customer Satisfaction Information.

Caterpillar may receive equipment information that is personally identifiable by another party, e.g., the equipment owner, but in most instances Caterpillar will not be the controller of that information.

Employees:

• Background Information (e.g., birth date, marital status, dependent information, ethnicity and/or nationality);
• Residency Information (e.g., work permit status);
• Financial Account Information;
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues);
• Background Check Information (e.g., credit and criminal background checks, drug and alcohol testing);
• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims);
• Biometric Information (e.g., thumbprints);
• Trade Union affiliation;
• Automotive Information (e.g., driving history, vehicle registration, driver’s license number);
• Professional Qualifications Information (e.g., work experience, education); and
• Employment-related Information (e.g., work history, new hire forms, skills, education and training, performance appraisals, goals, attendance, work absences, vacation entitlement and requests, compensation history, workplace injury and illness reporting, disciplinary issues, and grievances).

Suppliers:

• Residency Information (e.g., work permit status);
• Financial Account Information;
• Background Information (e.g. due diligence)
• Professional Qualifications Information (e.g., work experience, education);
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues); and
• Biometric Information (e.g., thumbprints).

Depending on the applicable local law, some personal information collected by Caterpillar may be considered “sensitive personal information” (i.e., personal information subject to additional protections).

Additionally, in some cases, such as where you are the sole proprietor of a business, information about your company may be deemed personal information. This could include business information (e.g., office address), financial account information (e.g., bank account information, trade references, financial statements), assets (e.g., property ownership), credit rating, tax identification, and diversity classification.

Caterpillar may use anonymized (or de-identified information), that was derived from personal information, but in its anonymized form cannot be identified with a specific individual. This de-identified information is not considered personal information for purposes of this Privacy Statement and is not covered by this Privacy Statement. However, if such information is used or formatted in such a way that it is possible for that information to be identified with a specific individual, then it will be considered personal information as appropriate.

Caterpillar collects personal information in a variety of contexts from different categories of persons.

Customers (either directly or, in some cases, through third parties) can provide personal information through the business relationship involved in acquiring, marketing, or selling Caterpillar products or services. This includes, for example, submission of personal information as part of a proposal, a contract, receiving and employing services or products (including repair and warranty services), and potentially accessing Caterpillar systems or monitoring Caterpillar processes. Throughout the duration of a customer relationship, Caterpillar reserves the right to request, as needed, other forms of personal information necessary to facilitate the purposes described below.

Employees can provide personal information directly during the application and on-boarding process, throughout the duration of employment, and, in some cases where permitted, upon separation. In addition, Caterpillar may collect the information described above from a third party, for example, when we contact references that were provided to Caterpillar by an employee, or when we obtain background check information in accordance with our policies and applicable laws in connection with an employee’s application or on-boarding process. Much of this information is voluntarily provided to Caterpillar as a condition of employment to facilitate Caterpillar’s management of the employer-employee relationship, which is vital to our collective success.

Suppliers can provide personal information through the business relationship involved in acquiring, marketing, or selling Caterpillar products or services. This includes, for example, submission of personal information as part of a proposal, a contract, delivering services or products, and potentially accessing Caterpillar systems or monitoring Caterpillar processes. Throughout the duration of a supplier relationship, Caterpillar reserves the right to request, as needed, other forms of personal information necessary to facilitate the purposes described below.

Caterpillar processes your personal information where it is permitted to do so under applicable data protection laws, including for the purposes of its legitimate interests, to comply with a legal obligation of Caterpillar, and where you have consented for Caterpillar to do so.

In some cases, your consent to the collection of your personal information may be provided in a manner appropriate to the context, meaning it can be provided orally, in writing, electronically, or—when permitted by local laws—it may be implied where the purpose is apparent from the circumstances and you voluntarily provide your personal information. Subject to local laws, and as may be articulated in the attached country-specific appendices, there may be circumstances under which Caterpillar must obtain explicit consent from you. Such consent is your choice and is entirely voluntary. In some circumstances, you may withdraw your consent to Caterpillar’s collection and use of personal information subject to contractual and legal restrictions and reasonable notice.

Caterpillar uses personal information in ways that are compatible with the purposes for which the information was originally collected. This may include use for a purpose that is reasonably related to the original purpose of collection. Caterpillar collects, uses, and discloses personal information as an essential part of operations.

Additional information describing how we use this personal information may be provided in the supplemental appendices that describe unique legal obligations and rights available in different jurisdictions.

Personal information may also be processed in order to meet legal requirements applicable to Caterpillar, such as filing with government agencies, complying with lawful orders to provide information, meeting contractual commitments, and in connection with Caterpillar safeguarding its rights and property.

Personal information is vital to our management and administration of customer, employment, and supplier relationships generally. Subject to local law and any attached appendices, personal information is collected from different categories of persons for different purposes. Below, we describe the different purposes for collecting personal information from customers, suppliers, and employees.

Customer Personal Information Collection Purposes

Caterpillar uses customer personal information to conduct business operations (e.g., satisfy customer orders), market new products through individual outreach or group communications (e.g., newsletters), assess internal performance, manage customer relationships, (e.g., invoicing and payments), manage risk and compliance, and support various administrative functions. Some examples of personal information Caterpillar may collect from customers and accompanying uses include:

Employee Personal Information Collection Purposes

Caterpillar uses employee personal information to conduct business operations (e.g., managing access control, security systems, and updating personnel directories), foster employee development (e.g., Training), support various administrative functions (e.g., administering compensation plans, benefits, and leave schedules), and manage the operation of our businesses.

Some examples of personal information that Caterpillar may collect from employees and accompanying uses include:

Supplier Personal Information Collection Purposes

Caterpillar uses supplier personal information to conduct business operations (e.g., managing access control and security systems), select and approve new suppliers, assess supplier performance, manage supplier relationships, (e.g., invoicing, and payments), manage risk and compliance, and support various administrative functions.

Some examples of personal information Caterpillar may collect from suppliers and accompanying uses include:

Section 5. How does Caterpillar safeguard personal information?

Caterpillar utilizes reasonable measures, including information technology security and physical security measures, to protect personal information. These measures are appropriate to the risks posed by the processing of personal information and to the sensitivity of the personal information, and take into account the requirements of applicable local law. Caterpillar requires all persons to abide by applicable security policies related to personal information when using Caterpillar systems.

Section 6. How long does Caterpillar keep personal information?

Caterpillar stores personal information as needed to accomplish the purposes identified above and to meet legal requirements, including record retention. Our retention of your personal information is at all times subject to local law. This storage period may extend beyond the term of your relationship with Caterpillar.

Section 7. How does Caterpillar dispose of personal information?

When personal information is no longer useful, or in any event, after legal authority to retain it has expired, personal information will be destroyed, in accordance with local law and pursuant to procedures established by the relevant Caterpillar system or process.

Because Caterpillar operates a global business, we may need to transfer your personal information to different jurisdictions for our business purposes. Caterpillar may transfer personal information to countries or jurisdictions that may not legally mandate the same level of data protection as the jurisdiction in which that personal information was collected. This Privacy Statement applies to all Caterpillar operations and their data processing activities and Caterpillar has entered into data transfer agreements with its affiliates worldwide to protect personal information.

Caterpillar only shares personal information with others in a manner consistent with this Privacy Statement, for the purposes stated above, when required by law, or with your consent. Information transfers to third parties will generally be transfers to third-party processors for those purposes consistent with this Privacy Statement. In addition, Caterpillar may transfer personal information to third-party data controllers as required by law, with your consent, or with approval from a relevant authority. In some jurisdictions, transfer of specifically delineated categories of data or transfer to certain third parties may require explicit consent from you. In all instances, the transfer of personal information is subject to local law and the attached appendices.

When Caterpillar shares personal information with third parties that process the personal information on Caterpillar’s behalf (e.g., contractors, consultants), Caterpillar takes reasonable steps to require such recipients to protect personal information in accordance with applicable laws. Examples of third parties with whom we may share information for any of these purposes include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies (when required by law; authorized by the customer; to protect Caterpillar, a person or property; and to support our business, such as in applications for government grants);
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar;
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business; and
• (Employees only) Vendors providing medical or financial planning services to employees.

Caterpillar takes steps to maintain the accuracy and completeness of personal information. You may request and will receive reasonable access to the personal information you have provided to Caterpillar and have an opportunity to correct it if necessary. Caterpillar procedures grant you access to your personal information and enable the exercise of other rights that may be available to you under applicable local law.

Unless prohibited by local law or, in some cases, as mandated by local law, your right to access your personal information may be limited. Examples for why your access may be limited include:

• The request relates to legal advice and proceedings;
• A legal privilege may be claimed regarding the subject matter of the information;
• The personal information also includes the personal information of a third party who has not consented to disclosure and whose privacy would be affected by any such disclosure;
• The request is insufficiently detailed or has already been responded to; 
• The request is frivolous or vexatious; or
• (Employees only) The information could disclose a confidential reference.

Caterpillar will consider local laws when reviewing requests to access or alter personal information held by Caterpillar.

If you are a customer, please contact the person representing Caterpillar to whom you have given your personal information for the proper procedure for obtaining access to your personal information.

If you are an employee, please contact your local, regional or corporate Human Resources representative for the proper procedure for obtaining access to your personal information. Upon request, and after providing satisfactory proof of identity and any additional requirements established by applicable local law, you will be given access to your personal information that you have a right to review and, if appropriate, the option to copy, modify, delete, or contest that personal information in Caterpillar’s systems.

If you are a supplier, you may contact the individual at your organization who is responsible for the Caterpillar relationship and who maintains a Corporate Web Security Identification (CWS ID) and/or has access to the Supplier Data Management Application (e.g. Supplier Connect) for “self-service” access.

Section 10. Where can you obtain further information?

If you have any questions about this Privacy Statement, please email dataprivacy@cat.com or call the contact listed below. If you believe your personal information has been handled in a manner inconsistent with this Privacy Statement you should not hesitate to reach out to dataprivacy@cat.com or Caterpillar’s Office of Business Practices at https://www.caterpillar.com/en/company/code-of-conduct/office-of-business-practices.html or by calling +1 (800) 300-7898 or the country specific phone number listed on the above referenced website.

Data Privacy Point of Contact:

• Title: Director, Data Privacy
• Name: Mr. Todd Wagner
• Address: 100 NE Adams St., Peoria, IL 61629
• Telephone: +1 309-494-3282(DATA)
• Email: dataprivacy@cat.com

Additionally, contact information for your local Data Controller may also be provided in your purchase order or any other agreement you have with Caterpillar.

If you are an employee, you can receive more information through your local, regional or corporate Human Resources representative at:

• Human Resources, 100 N.E. Adams Street, Peoria, IL 61629, USA
• corporate_hr@cat.com

In some cases, contact information for your local Human Resources representative is included in your Employee Handbook or Agreement.

Section 11. What happens if this Privacy Statement changes?

We reserve the right to amend this Privacy Statement as needed. When we do, the changes will be communicated to affected persons at that time, and we will note near the top of this Privacy Statement the date that any such changes are made and/or when they become effective. In some instances, if the changes we make are material, we may also send you an e-mail message or other communication telling you about such changes and any choices you may have or actions you can take before they go into effect. Depending on the nature of the changes and subject to local law, your continued relationship with Caterpillar will demonstrate your acceptance of those changes.

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information (including special categories of personal information) in or from certain countries in the European Economic Area (“EEA”). This Appendix is applicable to individuals who do not have an employee / human resources relationship with Caterpillar. For more information please see Caterpillar’s Global Data Privacy Statement. For more information on how Caterpillar collects and processes non-personal information, please see Caterpillar’s Global Data Governance Statement.

If you were referred to this EEA Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this EEA Appendix, the relevant controllers are listed in Schedule A to Caterpillar’s Global Privacy Statement in the table identified as “Caterpillar Data Controllers.” 

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This EEA Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (“GDPR”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this EEA Appendix.

Section 2. What sensitive personal information could Caterpillar collect and process?

Sensitive personal information (also known as special categories of information) requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store and use the following, which may include or be considered “special categories” of information (as defined above):

• Background Information (e.g., marital status, dependent information, ethnicity and/or nationality, credit and criminal background checks, and drug and alcohol testing); and
• Biometric Information (e.g., thumbprints).

Section 3. Why does Caterpillar use your personal information?

We need all the categories of information collected primarily to allow us to manage our relationship with you in order to operate our business and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Non-Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary in order to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where it is necessary for the performance of a contract.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).

The legal grounds we rely on to process your personal information are listed in Table 1.

Section 5. What are special categories of personal information used for at Caterpillar?

We will use your special categories of personal information for the following purposes:

• Information related to biometric data, to identify or authenticate users and for access control purposes.
• Background check information, to evaluate and select individuals with whom Caterpillar is working.

We may process special categories of personal information (as defined above) because we have a lawful basis for doing so (as set out above) and because in limited circumstances, we have your explicit written consent. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information in the course of legitimate business activities with the appropriate safeguards.

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under European data protection laws (and subject to the manner in which they and other laws and regulations apply to and must be complied with by Caterpillar), you have the right to object to automated decision making using your personal information.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. We also rely on consent in other situations as identified in Table 1.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing you with a product), or we may be prevented from complying with our legal or regulatory obligations.

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the EU?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside the EEA if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. Please contact your Caterpillar contact or email dataprivacy@cat.com for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate personal information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to review, verify, correct or request erasure of your personal information, object to or restrict the processing of your personal information, or request that we transfer a copy of your personal information to another party, please contact dataprivacy@cat.com for the proper procedure.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact dataprivacy@cat.com or use any unsubscribe options we may provide you in the context of our processing activities. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 1. Non-Human Resources Data Subjects EEA]

This Appendix to the Caterpillar Global Data Privacy Statement provides additional information about how Caterpillar collects, stores, uses, transfers and otherwise processes personal information (including special categories of personal information) in or from certain countries in the European Economic Area (“EEA”). This Appendix is applicable to individuals who have an employee / human resources relationship with Caterpillar. For more information, please see Caterpillar’s Global Privacy Statement.

If you were referred to this EEA Appendix from an agreement you have with Caterpillar, then the data controller for the personal information that is being processed in connection with that agreement will be the legal entity referred to in that agreement. For the purpose of this EEA Appendix, the relevant controllers are listed in Schedule A to Caterpillar’s Global Privacy Statement in the table identified as “Caterpillar Data Controllers.”

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal information. This EEA Appendix describes how we collect, store, use, and transfer personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (“GDPR”). As Data Controller, we are required under data protection legislation to notify you of the information contained in this EEA Appendix.

Section 2. What sensitive personal information could Caterpillar collect and process?

Sensitive personal information (also known as special categories of information) requires a higher level of protection. This is personal information which reveals or contains: racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

We may collect, store and use the following, which may include or be considered “special categories” of information (as defined above):

• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims) related to, among other things, physical or mental health, disability status, sickness absence, and family related leaves;
• Background Information (e.g., marital status, dependent information, ethnicity and/or nationality, credit and criminal background checks, and drug and alcohol testing);
• Biometric Information (e.g., thumbprints); and
• Trade Union affiliation.

Section 3. Why does Caterpillar use your personal information?

Personal information is vital to our management and administration of employment relationships. We need all the categories of personal information collected primarily to allow us to manage our relationship with you and to enable us to comply with our legal and regulatory obligations. In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The reasons for which we, or a contracted third party, will process your personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Human Resources Data

Section 4. What are Caterpillar’s lawful bases for processing your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will rely on one or more of the following bases for processing your personal information:

• Where it is necessary for the performance of a contract we have entered into with you.
• Where it is necessary in order to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest or for official purposes.
• Where we have obtained your prior consent (this is only used in relation to voluntary processing and is not used for processing that is necessary or obligatory).

We will rely on legitimate interests as the lawful basis for processing the categories of personal information set out below and in each case, we have identified the legitimate interest upon which we rely. (We also identify supplemental bases for processing certain categories of information where warranted.)

Section 5. What are special categories of personal information used for at Caterpillar?

We will use your special categories of personal information for the following purposes:

• Information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws.
• Information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits.
• Information related to trade union affiliation to facilitate dues collection, maintain contact lists, and perform other business-related activities.
• Information related to ethnicity and/or nationality, to comply with employment and other laws.
• Information related to biometric data, to identify or authenticate users and for access control purposes.
• Information related to employment-related background checks, to evaluate and select individuals for a role within Caterpillar.

We may process special categories of personal information (as defined above) because we have a lawful basis for doing so (as set out above) and because:

• In limited circumstances, we have your explicit written consent;
• We need to carry out obligations or exercise specific rights in the field of employment and social security law and in line with our Global Data Privacy Statement;
• Where it is needed in the public interest, such as for equal opportunities monitoring and in line with our Global Data Privacy Statement; or
• Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public. We may also process such information in the course of legitimate business activities with the appropriate safeguards.

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision making producing a legal effect concerning individuals or that would have a similarly significant effect. In the event that you are interacting with a Caterpillar company that is performing such automated decision making you should receive a specific notice that outlines the details of the automated decision making.

Under European data protection laws (and subject to the manner in which they and other laws and regulations apply to and must be complied with by Caterpillar), you have the right to object to automated decision making using your personal information.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal or regulatory obligations (such as ensuring your health and safety).

Section 9. What if the purpose for which Caterpillar collected the personal information changes?

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If we do, you can expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third-party service providers (including contractors, designated agents, insurers and insurance brokers) and other entities of Caterpillar. Examples include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies;
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar; and
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business.

Section 12. When might Caterpillar share your personal information within Caterpillar?

We will share your personal information within Caterpillar as part of our regular business and reporting activities, in the context of a business reorganization or group restructuring exercise, for system maintenance support, for hosting of data and for other legitimate business reasons. Examples include:

• payroll;
• benefits provision and administration (including pensions);
• occupational health or medical assessments regarding your fitness to work and health and safety (e.g. work station assessments);
• insurance claims and notifications;
• provision and administration of recruitment assessments, training and professional development;
• library and research services such as subscriptions and memberships;
• building security access and maintenance;
• travel providers;
• telecommunications and messaging services such as our business continuity emergency notification system;
• hard copy archiving; and
• IT services.

Section 13. Why might Caterpillar share your personal information with Third Parties?

We will share your personal information with Third Parties for the following reasons:

• In order to comply with a legal or regulatory obligation, where such disclosure is required by a regulatory or supervisory authority, the police or a court of competent jurisdiction;
• Where it is necessary to administer the contract, working relationship and any associated benefits with or for you;
• For the purposes of auditing, insuring and in the course of seeking advice with regards to our business operations and claims handling; and
• Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the EU?

The personal information that we collect about you may be transferred to, and stored at, one or more countries outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for Caterpillar or for our third-party service providers. In such cases, we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this document. If we cannot ensure such an adequate level of data protection, your personal data will only be transferred outside the EEA if you have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of your personal information and provide the appropriate level of security for the risk, including measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. Details of those measures are available on request. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy which is available from the HR department. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Once you are no longer an employee, worker or contractor of Caterpillar, we will retain and securely destroy your personal information in accordance with our data retention policy.

Section 17. What is your duty to inform Caterpillar of changes to your personal information?

It is important that the personal information we hold about you is accurate and current. Please contact your Human Resources representative for the proper procedure for informing us of any necessary changes to your personal information that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate personal information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Lodge a complaint with the applicable supervisory authority with regard to our processing of your personal information.

If you want to review, verify, correct or request erasure of your personal information, object to or restrict the processing of your personal information, or request that we transfer a copy of your personal information to another party, please contact your local, regional or corporate Human Resources representative, or dataprivacy@cat.comfor the proper procedure.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Section 20. What is your right to withdraw consent?

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please your local, regional or corporate Human Resources representative. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information for the purpose or purposes you originally agreed to, and unless we have another lawful basis for continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix at any time, and we will provide you with updated documents when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

[END Appendix 2. Human Resources Data Subjects EEA]