Privacy Notice

Data Controller

This Privacy Policy outlines how Komatsu Forest AB and its full-owned subsidiaries process personal data.

Contact details

Komatsu Forest AB
Box 7124
907 04 Umeå, Sweden
E-mail: gdpr@komatsuforest.com 

When does this privacy notice apply

This privacy notice applies when you, as a resident of the European Union, the United Kingdom, Norway, Iceland, or Liechtenstein, or as a representative of a company or organisation established in one of the previous countries,

A. communicate with us via e-mail, phone, or any other digital communication channel,
B. agree with us or communicate with us in that context, including dealers and suppliers,
C. use or visit our social media, such as LinkedIn, Facebook, Instagram or YouTube,
D. apply for a position at our company,
E. register for or participate in our events, or
F. hand us your business card.
  

What personal data do we process?

We process multiple categories of personal data. We identify the following categories of personal data

A. Identity information, such as your name and surname
B. Contact information, such as your e-mail address, postal address, and telephone number
C. Employment information, such as the company you work for and your function
D. Content information, including the contents of the communications you have with us, the metadata relating to the communication, with whom you correspond, and the date and time of such communication
E. Order information, including the information about what you ordered, products, services and preferences made clear in the order
F. Financial information, such as a bank account number and other relevant identifiers,
G. Social media profile information, including information made publicly available on social media and your social media account
H. Photos and videos
I. Technical information associated with the device you use, such as your IP address, date and time, browser type, duration of interactions (including phone calls), geographical location, and operating system

Please note that we may also receive information that is not named under the above categories but that you choose to provide to us. Where this information is not relevant for the processing purposes named below, we will remove it.

Purposes of processing

For communication

When you communicate with us via social media, our communication forms (including on our website), telephone, e-mail, or any other digital communication channel, we collect and use identity information, contact information, content information, technical information, and any other information you choose to share with us.

For this processing purpose, we base ourselves on our legitimate interest in being able to communicate with customers, potential customers, suppliers, dealers, and other interested parties.

For concluding and executing agreements

When you negotiate or enter into an agreement with us, we will collect and process at least the identity, contact, financial and employment information you provide to us, including your name, e-mail, phone number and professional function. This information is required to fulfil our contractual obligations, including order management, shipping and warranty concerning you or the company you represent.

For this processing purpose, we base ourselves on our legitimate interest in concluding and performing agreements with our customers, dealers, and suppliers. However, where you contract directly with us, our legal basis is the performance of the agreement we conclude directly with you.

For marketing and advertising

When you have previously concluded an agreement with us for the purchase of our products or for engaging our services, we may send you marketing e-mails, brochures, newsletters, surveys, and other communications related to such (or similar) products and services. In this context, we process your identity, contact and employment information. We may also use content information to provide you with personalised communications.

For this processing purpose, we base ourselves on our legitimate interest in keeping you and the company you represent informed about our products and services, as well as in maintaining a good customer relationship.

When you are not in our system as a customer, we may send you marketing e-mails, brochures, newsletters, and other communication related to such (or similar) products and services when you subscribe to such communications. Registration happens via our website, where you provide us with your contact, identity, and employment information. After registration, you will receive an e-mail allowing you to confirm your wish to receive our communications. Please note that if we had earlier interactions, we may use content information to provide you with personalised communications.

For this processing purpose, we base ourselves on your explicit consent to receive such communications. Please note that you may revoke your consent at any time by clicking the link in every marketing communication. For more information, refer to the explanations below on how you can exercise your rights.

For social media interactions

When you interact with us on social media, including on Facebook, Instagram, YouTube and LinkedIn, we collect and process your identity, contact, social media profile, technical, and content information. In some instances, this information may also refer to photo or video material. This enables us to have meaningful interactions with you. Please note that some of the information mentioned may be public on the social media pages.

For this processing purpose, we base ourselves on our legitimate interest in being able to respond to requests, questions, or comments.

The social media pages may also contain publicly available information such as product or service reviews, customer experiences or reactions to our services.

For this processing purpose, we rely on our legitimate interest in tracking messages and interest in and about our services, as well as about us as a company, or the industry in which we operate.

For training and events

When you register for or participate in our events or trainings, we collect and process your identity, contact and employment information. If you interact with us during the event or training, we may process content information.

Where such an event or training takes place online, we may take photos and videos as well as process technical information on you. Where the event takes place in person, we may take photos and record videos. In such instances, we will generally propose you to sign a separate consent form.

For this processing purpose, we base ourselves on the agreement we conclude or specific event terms and conditions you accepted.

After the event or training, we may send you a message or survey to ask for feedback.For sending feedback we will process your identity and contact information.b

For this processing purpose, we rely on our legitimate interest to be able to organise events that lead to high interest and attendance rates or to promote our products and services.

For job applications

When you apply for a job with us, we process your personal data for the purpose of evaluating your application and your skills in our recruitment process.

For more information about our processing in connection with recruitment and the legal basis on which we support our processing, see the Recruitment Privacy Policy.

For compliance with legal obligations

To comply with our legal obligations or to comply with any reasonable request from competent police authorities, judicial authorities, government institutions or bodies, including competent data protection authorities, we may process any of the personal data referred to above.

For this processing purpose, we will always rely on a legal obligation requiring us to process the personal data.

For detecting and combatting fraud and illegal activities

To prevent, detect and combat fraud or other illegal or unauthorized activities we may process any of the personal data referred to above.

For processing this data, we rely on our legitimate interest in keeping our website, services, and operations safe and secure.

For legal proceedings

To defend ourselves in legal proceedings, we may process any of the personal data referred to above.

For processing this data, we rely on our legitimate interest in using your personal data in these proceedings.

For mergers, demergers and acquisitions

To inform a third party in the context of a possible merger with, acquisition of or by, or demerger by that third party, even if that third party is located outside the EU, we may process any of the personal data referred to above.

For processing this data, we rely on our legitimate interest in entering into business transactions.

Sharing with other parties

We generally do not share your personal data in an identifiable manner with any third party not working at or engaged by us without priorly informing you. In any case, anyone receiving access to your personal data will be bound by strict legal or contractual obligations to keep your personal data confidential and secure.

Considering the above processing purposes, your personal data may be shared with the following categories of recipients:
• You
• Your employer or business partners
• Our employees and suppliers
• Our official dealers
• Government and judicial authorities to the extent that we are obliged to share your personal data with them
• Service providers in the context of advertising
• Service providers in the context of social media
• Service providers in the context of our website and/or web shops
• Service providers in the context of our communications
• Our professional advisors

Please consider that, in addition to the previous, we may also share your personal data with other entities within the Komatsu Group. In that context, we will ensure that all group companies take due case that all processing is in line with what is set out in this privacy notice.

In the context of the above, your personal data may be shared outside the European Economic Area (being the European Union, Norway, Iceland, and Liechtenstein). Such sharing is considered a transfer of personal data to a third country. Where we transfer your personal data to a third country, we will ensure that appropriate safeguards are in place. Those safeguards may take the form of an adequacy decision taken by the European Commission or Standard Contractual Clauses of the European Commission, where necessary, supplemented with additional measures.

Retention of personal data

General

Your personal data will only be processed for as long as necessary to achieve the purposes described above or, when we have asked you for your consent, until you withdraw your consent (for which we will periodically remind you). As a general rule, we will remove or de-identify your personal data when it is no longer needed for the purposes described above or when the retention period, as explained here, has expired. Please note that we cannot delete your personal data if there is a legal or regulatory obligation or a court or administrative order preventing us from doing so.

Communications

All personal data we collect through our interactions with you through social media, telephone, email, or other digital communication channels will be retained for as long as necessary to communicate with you, but also to maintain a historical record of our communications. This allows us to return to previous communications when you come back to us with new questions, requests, comments, or other input.

Social media

All personal data we collect through our social media accounts is retained as long as necessary to protect our legitimate interests. Messages that you send to us via social media, your identity, contact details and technical details related thereto, will be retained as long as necessary to handle and follow up your question, request, comment, or other input. We will not retain this data longer than five (5) years after your message, after which it will be deleted or de-identified.

If information about our products or services, our company or our industry based on publicly available social media interactions contains personal data, we will retain it for as long as necessary to protect our legitimate interest. We will not retain this data longer than five (5) years after the collection of this information.

Purchases and orders

Information related to agreements we conclude and execute remains stored at least for the performance of the agreement we concluded. We will thereafter retain a copy of the relevant information to be able to provide warranty and support services, as well as to comply with our legal retention obligations under applicable fiscal laws and regulations.

Training and events

We will retain all personal data collected in connection with our trainings and events for as long as necessary to protect our legitimate interests. Identity and contact details in the context of your registration for or participation in an event will be retained until your personal data are no longer necessary in this context.

Any feedback you provide about a particular event, together with your identity and contact details where provided, will be retained for as long as necessary to process your feedback for future events. We will not retain this data longer than two (2) years after the event in question.

Job applications

We will process personal data about you when you are part of a recruitment process with us. For more information on what personal data we process and for what purposes see: Recruitment Privacy Policy.

Security

We take appropriate technical and organizational measures to keep your personal data safe from unauthorised access or theft as well as accidental loss, tampering or destruction. Access by our personnel or our third-party processors will only happen on a need-to-know basis and subject to strict confidentiality obligations. We have also taken other measures, such as taking internal policy measures, limiting the processing of the personal data necessary for the fulfilment of the purposes, minimizing the processing of personal data, taking backups of personal data, and periodically evaluating our security measures.

Your rights

You have the right to request access to all personal data processed by us insofar as it pertains to you. You can exercise this right by contacting us as set out below. We reserve the right to refuse multiple requests for access that are submitted for causing nuisance or harm to us or others.

You have the right to ask that any personal data about you which are inaccurate, are corrected free of charge. If a request for correction is submitted, such request must be accompanied by proof of the flawed nature of the data for which correction is asked.

You have the right to request that personal data about you be deleted if they are no longer required in light of the purposes outlined above. However, you need to keep in mind that a deletion request will be evaluated by us against:

• our own or a third party’s overriding interests; or
• legal or regulatory obligations or administrative or judicial orders which may contradict such deletion.

Instead of deletion, you can also ask that we limit the processing of your personal data if and when (a) you contest the accuracy of that data, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes which are outlined above, but you need them to defend yourself in judicial proceedings.

You have the right to withdraw your consent that was earlier given for the processing of your personal data at any time.

You have the right to object to the processing of personal data when we process your data on the basis of our legitimate interest. If you object, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims.

Where the purposes identified above rely on your consent or a (pre-)contractual obligation, you have the right to receive a copy from us, in a structured, commonly used, and machine-readable format, of any personal data you have provided to us.

Each request addressed to us can be sent via e-mail to gdpr@komatsuforest.com.

An e-mail requesting to exercise a right will not be construed as consent for the processing of your personal data beyond what is required for handling your request. Such requests should clearly state and specify which right you wish to exercise and the reasons for it if such is required. It should also be dated and signed, and – in general – be accompanied by a digitally scanned copy of your valid identity card proving your identity.

We will promptly inform you of having received this request. If the request proves valid, we will notify you as soon as reasonably possible and at the latest thirty (30) days after having received the request.

If you have a complaint about the processing of your personal data by us, you can always contact us at gdpr@komatsuforest.com. If you are not satisfied with our response, you may complain to the competent data protection authority, being the data protection authority of the country of your habitual place of residence, place of work or the place of an alleged infringement. In Sweden this is Integritetsmyndigheten.

Linked websites

Our website contains links to external websites as well as framed content of third parties. Please consider that these websites or website owners each have their privacy notices that apply. Read their privacy notice to learn more about how these websites or website owners process your personal data under the applicable data protection legislation.

Published June 13th 2024
Uppdated November 1st 2024