.svg){kind=icon}
Privacy policy for customers and third parties
Please take a few minutes to review our Privacy Policy for Customers and Third Parties. Upon completion of reading it, we kindly ask you to check the Confirmation box at the end of the text to indicate that you are aware of our Terms and Conditions.
Komatsu Group
- SCOPE
- PURPOSE AND APPLICATION
- DEFINITIONS
- SOURCES OF PERSONAL DATA
- PERSONAL DATA WE COLLECT AND HOW WE COLLECT IT
- COOKIES
- PURPOSE OF USAGE OF THE INFORMATION
- SHARING OF PERSONAL DATA
- RETENTION AND STORAGE OF YOUR PERSONAL DATA
- DATA SECURITY AND DISCLOSURE
- INTERNATIONAL TRANSFER
- RIGHTS OF THE OWNER
- RESPONSIBILITY
- CONSENT
- CHANGES TO THIS POLICY
- CONTACT US
01. SCOPE
This Privacy Policy (Policy) demonstrates our commitment to the privacy of Personal Data owners, explaining in detail how such data is handled by Komatsu.
02. PURPOSE AND APPLICATION
The purpose of this Policy is to establish guidelines for the processing of Personal Data arising from our activities. Komatsu may eventually obtain the personal information necessary to engage in the development and offering of advanced mining solutions, to operate in sales, services and rental of construction and mining equipment, industrial machinery, as well as to provide product and service support, training, customer service and other specific requests demanded by the Customer. This personal information may be used jointly by Komatsu and the Komatsu Group and other companies. The methods of collection and uses of personal data are described in this Privacy Policy.
This Policy applies specifically to:
- Customers: legal entities that contract, use, or access one or more Komatsu services or products and that share Personal Data with Komatsu as a result of the business relationship;
- Prospecting customers: Natural and/or legal persons who provide Personal Data for prospecting by Komatsu and/or who seek information about our services through our channels; who have already requested the contracting of one of the services or products, but who have not become a Komatsu customer for any reason;
- Job applicants at Komatsu that share personal data to participate in the selection process;
- Service providers: natural and/or legal persons who provide Personal Data for the provision of services to Komatsu. This Privacy Policy also applies to other ways Komatsu collects personal data, which enables us to provide or improve our services. For example, we may collect information through partners or related to our technologies.
If you are a Komatsu employee, our Employee Privacy Policy can be found on the Intranet or on Docnix.
03. DEFINITIONS
The Company uses the following definitions in this policy:
- General Data Protection Law or GDPL: this refers to Law No. 13.709/2018 and its subsequent amendments;
- Personal Data signifies any data or information relating to an identified or identifiable natural person;
- Treatment any and all operations performed with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction;
- Holder the natural person to whom the personal data being processed refers, in the context of the commercial relationship between Komatsu and the Customer, may be any employee or third party, natural person related to the Customer;
- ANPD the National Data Protection Authority, a public administration body responsible for ensuring, implementing, and overseeing compliance with the GDPL (Brazilian General Data Protection Law) and other data protection laws in Brazil;
- Incident unauthorized access and the accidental or unlawful destruction, loss, alteration, communication, or any other form of inappropriate or unlawful processing.
- Controller the natural or legal person responsible for decisions regarding the Processing of Personal Data and who ensures that the processing of Data is carried out in accordance with the provisions of the GDPL (Brazilian General Data Protection Law).
- Operator the natural or legal person who processes data on behalf of the Controller and for the sole purpose of performing the services, respecting the Purpose or as instructed by the Controller;
- Customer A legal entity that maintains a commercial relationship with Komatsu and contracts services and products, including clients who use our services and products through a Komatsu distributor and/or business partner, and who, for that purpose, share Personal Data of third-party collaborators;
- Komatsu Group refers to Komatsu and the companies belonging to its economic group.
- Company or Komatsu: individually, Komatsu do Brasil Ltda, or Komatsu Brasil International Ltda., or Joy Global Brasil Industria e Comércio Ltda., or Modular Mining Systems do Brasil Ltda.
Whenever the terms Komatsu, we or ours are mentioned, we are referring to Komatsu; similarly, whenever the terms "you," "your," or "yours" are mentioned, we are referring to the Customer.
04. SOURCES OF PERSONAL DATA
This Policy applies to Personal Data that Komatsu processes, in its capacity as Data Controller and/or Data Processor, to supply our products and services. We may collect Personal Data through online and offline means when the Customer:
- Contracts or uses any of our products or services, whether by renting equipment, providing product and service support, training, or other specific requests made by the Customer;
- Provides Personal Data for the purposes described below;
- Navigates the Company's web application platform, websites, and systems;
- Contact us through our customer service channels;
- Participates in surveys or promotions conducted by Komatsu.
05. PERSONAL DATA WE COLLECT AND HOW WE COLLECT IT
Depending on how the Customer interacts with the Company (as described above), we may collect the following information:
- Account Holder's Registration Data (name, address, telephone number, email address, photo ID);
- Information about the manufactured vehicle or component (chassis);
- Banking details;
- Location data generated by your activities (navigation assistance, searches, location sharing, etc.);
- Data relating to your purchase and use of our products and services (Customer preferences and settings, purchase history);
- Data resulting from the monitoring and maintenance management of equipment units when using our solutions;
- Your vehicle will also automatically collect data about the vehicle and its surroundings (location). This data (data recorded by the vehicle/machine) is normally associated with the vehicle's identification number, to lead to its identification.
07. PURPOSE OF USAGE OF THE INFORMATION
Here, we will describe the purposes for which we collect Personal Data:
- To provide our services with the necessary quality and excellence, or to guarantee the performance of Komatsu products;
- Customer access to Komatsu systems and solutions;
- Management and monitoring of our solutions;
- To fulfill obligations arising from any contract entered into between the Customer and the Company, such as exercising rights under product and service warranties, operations management, etc.
- To communicate with the Customer;
- To comply with our legal and regulatory obligations, which may include disclosing certain information to regulatory authorities.
- Regular exercise of Komatsu's rights;
- For other legitimate business purposes, including marketing, prospecting, market research, opinion polls, and promotion of our products and services, or those of our partners, including enabling offers and sending information about products, services, new features, functionalities, content, news, and other events relevant to maintaining our relationship;
- Credit analysis and queries regarding information in the Credit Information System (CIS) database;
- To manage accounts and records, support social responsibility activities, legal, regulatory and internal investigations, and debt administration;
- To ensure that website content is presented in the most effective way for the digital device, including conducting analyses related to website usage.
- To provide requested information or information that may be of interest to Customers.
08. SHARING OF PERSONAL DATA
Komatsu may share Personal Data with Komatsu Group companies, third-party partners, and regulatory authorities and bodies for various purposes, when necessary. Komatsu requires all third parties to maintain the confidentiality of information shared with them or to which they have access by virtue of their business activities, and to use such information exclusively for the purposes expressly permitted.
Whenever data sharing occurs, it will be carried out within the limits and purposes of our business and in accordance with applicable law. Below, we list the purposes of sharing according to the category of our recipients:
- Komatsu Group Companies
- Providing services and offering the contracted products to the Customer;
- Operationalization and offering of new services and products;
- Marketing, prospecting, market research, opinion polls, and promotion of our products and services;
- Prevention and resolution of technical or security problems;
- Audits;
- Investigations and measures to prevent and combat illegal activities and fraud;
- Regular exercise of Komatsu's rights;
- Compliance with a legal or regulatory obligation.
- Business partners, distributors, service providers and other third parties
- Reselling and distributing our services and products;
- Improving our services, solutions, systems, website and application, and implementing new products or services;
- Assistance in providing services;
- Customer Contact;
- Customer Support;
- Prevention and resolution of technical or security problems;
- Investigations and measures to prevent and combat illegal activities and fraud, and to guarantee the security of our Customers.
- Regular exercise of Komatsu's rights;
- Compliance with a court order, an order from a competent authority, or an order from a regulatory body;
- Outsourcing of labor;
- Compliance with a legal or regulatory obligation.
- Authorities and regulatory bodies
- Investigations and measures to prevent and combat illegal activities and fraud, and to guarantee the security of our Customers.
- Regular exercise of Komatsu's rights, including submitting documents in judicial and administrative proceedings, if necessary;
- Compliance with a court order, responding to a request from a competent authority or regulatory body;
- Compliance with a legal or regulatory obligation.
09. RETENTION AND STORAGE OF YOUR PERSONAL DATA
Personal Data will be kept in a secure and controlled environment while you are a Customer and for as long as necessary to satisfy the purposes of collection, or to comply with applicable legal requirements. Personal data used to provide a personalized experience will be kept for as long as permitted by applicable laws.
Only authorized individuals can access Personal Data. We take reasonable security measures and adopt best practices for storing information within our operational environments.
In order to comply with legal obligations, Komatsu may store certain data for an additional period for auditing purposes, compliance with legal or regulatory obligations, or the regular exercise of rights as required by applicable law.
10. DATA SECURITY AND DISCLOSURE
We use appropriate measures to keep Personal Data confidential and secure to ensure its integrity and prevent incidents. Note, however, that these protections do not apply to information that the Data Subject has chosen to share in public areas, such as third-party social networks.
11. INTERNATIONAL TRANSFER
Komatsu may transfer some or all of your Personal Data abroad when:
- (i) are shared with Komatsu Group companies located outside of Brazil for the purposes described in item 7 above; and
- (ii) stored on cloud computing servers located outside of Brazil.
To this end, Komatsu carries out the transfer in accordance with the rights of the Data Subject and the data protection regime provided for by the GDPL (Brazilian General Data Protection Law), as well as adopting best security and privacy practices to guarantee the integrity and confidentiality of your Personal Data.
12. RIGHTS OF THE OWNER
The GDPL ensures that the Owner of Personal Data can exercise their rights in relation to the controllers of their information at any time and upon request. The references below demonstrate how the Owner can exercise their rights and the means to obtain assistance.
Confirmation of the existence of Processing and Access to Personal Data. The Owner may request that Komatsu confirms whether it processes their Personal Data, and request that Komatsu informs them of the Personal Data it holds about them. In this case, Komatsu will demonstrate the categories of personal data; and for how long the Personal Data will be stored.
Data portability to another service or product provider. The Data Subject may request that Komatsu transmit the Personal Data it holds to another Data Controller, ensuring that it is transmitted with the appropriate level of security, respecting Komatsu's trade and industrial secrets.
Information on the entities with which Komatsu has shared or currently shares data. The Data Subject may request that Komatsu provide information regarding the sharing of Personal Data with third parties.
Correction of incomplete data. If the Owner finds that their personal data is incomplete, inaccurate, or outdated, they may request that Komatsu correct or supplement the Personal Data.
Information regarding the possibility of not providing consent. If consent is required to use a particular product or service, the Data Subject may request that Komatsu clarify whether it is possible to provide that product or service without consent for the Processing of their Personal Data, or what the consequences are of not providing consent in this case.
Anonymization, blocking, or deletion of unnecessary, excessive, or illegally processed data. If any personal data is processed unnecessarily, excessively for its intended purpose, or in violation of the GDPL, the Owner may request that Komatsu anonymize, block, or delete such data, provided that the excess, lack of necessity, or violation of the law is effectively verified. To the extent technically feasible, Komatsu will anonymize Personal Data and observe the minimization of Handled Personal Data.
Revocation of Consent. The Owner may, at any time, request the revocation of the Consent given for the Processing of their Data. Komatsu will contact and communicate with other organizations where Personal Data is being processed, in order to stop the processing of information as requested by the Owner. Revoking consent may result in the termination of services provided, but it does not prevent the use of anonymized data and data whose processing is based on another legal basis provided for in the GDPL.
Complaint to the National Authority. Through the ANPD (National Data Protection Authority), the Owner will be able to file a complaint with the ANPD regarding their Personal Data. If the Owner has any complaints or questions regarding the processing of data, they may contact us through one of the channels indicated at the end of this section below, and we will be available to assist them with the matter.
Deletion of Personal Data. If the Owner has given consent to the processing of their personal data for specific purposes (and not necessary for the provision of our services or delivery of our products), they may request the deletion of this personal data. Please note that if the retention/storage of Personal Data is due to situations such as legal or regulatory obligation, this data may be retained/stored regardless of the Data Subject's Consent, as an exceptional case of Processing.
Opposition to Handling, if irregular. The Owner may object to the Handling of their Personal Data if it is found to be unlawful. Komatsu will take appropriate measures without undue delay in the event of a dispute regarding the processing of data, in whole or in part.
Review of automated decisions. The Owner may question decisions made solely on the basis of personal data processed automatically that affect their interests, such as decisions intended to define their personal, professional, consumer and credit profile or aspects of their personality, as well as know what criteria and procedures are used for the automated decision, respecting commercial and industrial secrets.
Should the Owner wish to exercise any of these rights, the Customer must provide our contact information so that the Owner can contact us via our email address: https://www.komatsu.com.br/source/lgpd.php or directly with our DPO, whose contact information is available on our website under the Contact icon. To ensure exercising of the Owner's rights, we may request proof of identity as a security measure and to prevent fraud.
The Owner may exercise the rights described above from the date that the GDPL comes into effect.
13. RESPONSIBILITY
Some Personal Data may be shared with and received by Komatsu through our business partners for the execution and/or quotation of services and sales. In this case, Komatsu will act as a Personal Data Processor, meaning that Komatsu will have access to and process the data only and exclusively in accordance with the instructions of the business partner as established in the contract. In accordance with the GDPL, the Controller and the Processor have joint and several liability regarding its Handling and therefore adopt sufficient technical and administrative measures to keep the data secure.
14. CONSENT
Due to some handling purposes involving the need for Owner consent, each party must obtain such consent for subsequent processing and handling. The Customer must obtain the consent, as applicable, of each Owner regarding the purposes established in this Privacy Policy for the provision of Komatsu services, in accordance with the data categories informed in item 5, and for the purposes foreseen in item 7.
15. CHANGES TO THIS POLICY
If the way we handle Personal Data changes, we may update this Policy and our practices at any time. The current version will always be the one published on our website.
If the change involves practical alterations to data handling that depend on consent, we will request such consent based on the new terms.
16. CONTACT US
Questions, comments, and requests related to this Privacy Policy and how the Company handles Personal Data are welcome and should be sent to our email address: GDPL or directly with our data protection officer (DPO).
We will receive and investigate any complaints about how we handle Personal Data (including complaints about violations of your rights under applicable privacy laws, particularly in relation to the General Data Protection Law).
Correspondence
Komatsu do Brasil Ltda – Proteção de Dados e Privacidade
Supervisor: LF Consultoria
Legal Representative: Luiz Antonio Ferraro Mathias
Email: dpo@lfconsultoria.srv.br
Address: Rodovia Indio Tibiriçá, 2000
Vila Sol Nascente - Suzano - CEP 08655-000 - São Paulo – SP
Komatsu Brasil International Ltda – Data Protection and Privacy
Supervisor: Pinhão e Koiffman Advogados
Legal Representative: Hélio Ferreira Moraes
Email: dpo.kbi@global.komatsu
Address: Av. Dr. Cardoso de Melo, 1340 - 12º andar
Bairro Vila Olímpia, São Paulo - SP, CEP 04548-004
Modular Mining Systems do Brasil Ltda – Data Protection and Privacy
Supervisor: Pinhão e Koiffman Advogados
Legal Representative: Hélio Ferreira Moraes
Email: privacidade@global.komatsu
Address: Av. Dr. Cardoso de Melo, 1340 - 12º andar
Bairro Vila Olímpia, São Paulo - SP, CEP 04548-004
Updated in: May/2021