Smart Construction Cloud Privacy Policy

This Privacy Policy governs the processing of personal data which takes place when you visit, or are active as an operator of a Komatsu machine on, a jobsite located in the European Economic Area or EEA (which consists of the EU, Norway, Liechtenstein or Iceland) where Smart Construction Cloud (“SCC”) is deployed.

SCC is cloud-based platform which combines ground-based and aerial mapping and visualization tools with progress measuring tools and remote support and transferring drawings to machines embedded in Komatsu machines to increase overall jobsite efficiency. Essentially it allows to create 2D and 3D topographical maps of a jobsite using unmanned aerial vehicles (drones) which are subsequently used to determine how operators of Komatsu machines can fulfil the required tasks at hand as efficiently as possible.

SCC is globally managed and maintained by Komatsu Limited, a Japanese corporation having its principal place of business at no. 3-6, Akasaka 2-Chome, Minato-Ku, Tokyo, Japan (“Komatsu”). SCC is made available in the EEA by Komatsu Europe International NV, a corporation organised and existing under the laws of Belgium, with registered office at 1800 Vilvoorde, Belgium, Mechelsesteenweg 586, registered in Brussels under number RPR/CER(0)404.968.268 (“Komatsu Europe”, together with the other Komatsu subsidiaries in the EEA referred to as “we” or “us”). Komatsu Europe acts as Komatsu’s representative in the EU with respect to SCC.

Multiple parties are responsible for the processing of your personal data via and in SCC. Komatsu, Komatsu Europe, Komatsu distributors and/or dealers, as well as the owner of the machine and your employer (when your employer is not the owner and you visit the jobsite as part of your job) are all responsible for the processing of your personal data through SCC, but only for as long as such personal data remains in SCC accessible to the aforementioned stakeholders.

To arrange for the aforementioned shared responsibility, Komatsu, Komatsu Europe, the distributors, dealers, owners and your employer (where relevant) have put in place contractual arrangements between them which govern this shared responsibility.

The essence of these arrangements is that you can always direct your questions and requests regarding the processing of your personal data (i.e. storage, collection, transfer etc. of all information that relates to you as operator) to the party with whom you have the most direct relationship

In principle this means that you should first and foremost refer to your employer (if you are an employee) or your customer (if you are an independent contractor). Komatsu, Komatsu Europe, Komatsu distributors and dealers, as well as the owner of the machine and your employer/customer (if he is not the owner) will liaise between each other to ensure that your questions, requests and rights regarding the processing of your personal data are given due regard.

To be clear:

• For staff members of Komatsu Europe or of other Komatsu subsidiaries in the EEA, the request can be directed directly to Komatsu Europe by sending an e-mail to PrivacyOffice@komatsu.eu
• For staff members or independent contractors of a distributor, a dealer or an owner, meaning you either work for or on behalf of a distributor, a dealer or an owner, you are to contact the distributor, the dealer or the owner with your questions or requests.
• For staff members or independent contractors of another entity than the ones referred to above, you are to contact first and foremost your employer or customer.
• For occasional jobsite visitors who are none of the above, you are to contact Komatsu Europe by sending an e-mail to PrivacyOffice@komatsu.eu

If you are unsure who to contact, please send an e-mail to Komatsu Europe at PrivacyOffice@komatsu.eu stating your full name, function title and entity you work for as well as jobsite on which your personal data were captured by SCC, and we will refer your request to the appropriate responsible party.

When you visit a jobsite where SCC is deployed, the following types of personal data are collected and processed:

• your image
• your location
• your activity on site
• personal identification data (e.g. names)
• current employment (e.g. function title and employer details)

When you work as an operator of Komatsu machines on a jobsite where SCC is deployed, the following types of personal data are collected and processed additionally:

• details regarding:
  • your use and operation of the machine
  • machine location and position
  • usage times and statistics
  • productivity of the Machine
  • error codes and frequency of those codes

When your personal data are processed via SCC, such processing takes place for the following reasons:

1. Jobsite mapping and task planning
2. Safety and security
3. Warranty
4. Misuse and theft prevention
5. To provide training and develop training materials
6. To improve machine and operational efficiency
7. Where applicable: to follow-up on rental agreements
8. To improve the SCC system and its associated services
9. To evaluate, analyse and report on machine usage
10. To defend ourselves in legal proceedings
11. To comply with a legitimate request from law enforcement or other authorities

We may also process your personal data to inform a third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the EU.

Please note that, when you are an operator of a Komatsu machine, your employer can also use SCC to process your personal data to evaluate your performance as employee, but this is entirely between you and your employer.

The data protection laws require us to precisely indicate to you which legal option we rely on to make the processing of your personal data legitimate. We need to clarify this for each of the purposes listed in section 3 above.

For the purposes (a) to (j) as indicated in section 4 above as well as for the purpose of informing a third party in the context of a possible merger, acquisition or demerger, the processing of your personal data is necessary for our legitimate interests, which in this case concern:

• assist with mapping the jobsite and planning of tasks
• ensuring the safe and secure deployment of the machines
• preventing misuse and theft
• commercial interests which include handling warranties, the need to be able to improve the SCC system, our machines and services and training materials and the need to be able to enter into corporate transactions

For purpose (k) we need to process your personal data to comply with our legal obligations.

Your personal data may be sent to the following categories of recipients:

• yourself
• your employer or business relations
• companies within the Komatsu group of companies, including our affiliates, as well as our service providers who help us to provide SCC
• governmental, judicial and other competent bodies in case of a justified yet legally binding request

Your personal data are transferred to Japan, for which model contract clauses on the basis of European Commission decision 2004/915/EC have been put in place between Komatsu and Komatsu Europe. Your personal data are also transferred to Komatsu processors in the USA for which model contract clauses on the basis of European Commission decision 2010/87/EC have been put in place.

For more information, please address your questions to PrivacyOffice@komatsu.eu

Your personal data are only processed for as long as needed to achieve the purposes listed in section 4 above. At minimum your personal data will be retained in the SCC platform until all possible claims related to the use of SCC on the jobsite have been time-barred.

We will de-identify your personal data when they are no longer necessary for the purposes outlined above, unless there is:

• an overriding interest of Komatsu, Komatsu Europe or any other third party in keeping your personal data identifiable
• a legal or regulatory obligation or a judicial or administrative order that prevents us from de-identifying them

You have the right to request access to all personal data processed in SCC insofar it pertains to you. We reserve the right to refuse multiple requests for access that are clearly submitted for causing nuisance or harm to Komatsu, Komatsu Europe or other parties.

You have the right to ask that any personal data pertaining to you which are inaccurate, are corrected free of charge. If a request for correction is submitted, such request must be accompanied of proof of the flawed nature of the data for which correction is asked.

You have the right to request that personal data pertaining to you will be deleted if they are no longer required in light of the purposes outlined above. However, you need to keep in mind that a request for deletion will be evaluated by us against:

• overriding interests of Komatsu, Komatsu Europe or any other third party
• legal or regulatory obligations or administrative or judicial orders which may contradict such deletion

Instead of deletion you can also ask that we limit the processing of your personal data if and when (a) you contest the accuracy of that data or have objected to the processing of your personal data and a decision is pending, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes which are outlined above, but you need them to defend yourself in judicial proceedings.

You have the right to oppose the processing of personal data for the purposes (a) to (j) in section 4, but you are required to explain your particular circumstances on which your request for opposition is based.

As explained earlier, if you wish to submit a request to exercise one or more of the rights listed in this section, you must first and foremost contact your employer. Each request addressed to us can be send via e-mail to PrivacyOffice@komatsu.eu for all data subject rights matters.

An e-mail requesting to exercise a right will not be construed as consent with the processing of your personal data beyond what is required for handling your request. Such request should clearly state and specify which right you wish to exercise and the reasons for it, if such is required. It should also be dated and signed, and accompanied by a digitally scanned copy of your valid identity card proving your identity.

Without prejudice to the allocation of responsibilities as outlined in section 1, we will promptly inform you of having received this request. If the request proves valid, we will notify you as soon as reasonably possible and at the latest thirty (30) days after having received the request.

If you have any complaint regarding the processing of your personal data by Komatsu or Komatsu Europe via SCC, you may always contact us via the e-mail address mentioned in the first paragraph of this clause. If you remain unsatisfied with our response, you may file a complaint with the competent data protection authority.