Legal

This Privacy Statement applies to the Caterpillar subsidiaries, affiliates, and other entities controlled by Caterpillar Inc. as are identified in Schedule A (List of Caterpillar Data Controllers / Legal Entities) (collectively, “Caterpillar”). This Privacy Statement applies only when Caterpillar is collecting or otherwise processing personal information for Caterpillar’s purposes (i.e., when Caterpillar (either alone or in common with other entities) is a controller and therefore determines the purposes for which and the manner in which any personal information is processed). This Privacy Statement does not apply when Caterpillar is collecting or otherwise processing personal information on behalf of another company, such as Caterpillar’s dealers, suppliers, and customers.

The applicable Caterpillar entity that is the “controller” of your data is the one with which you have a relationship, including for example: as a customer (e.g., the Caterpillar company referred to in your purchase order or other agreement with Caterpillar), an employee (e.g., the Caterpillar company that you are attempting to or have entered into a relationship with), or a supplier (e.g., the Caterpillar company that you are attempting to or have entered into a supplier relationship with). Caterpillar encourages the periodic review of this Privacy Statement to stay aware of any changes it.

For convenience, in several sections this Privacy Statement is organized by the category of data subjects identified below. Please note that in some situations, you may not fit perfectly into any one category (for example, more than one could apply, or you might not be a customer of Caterpillar, yet the customer section is the most applicable). Please review all of the language that is appropriate to your relationship with Caterpillar. This Privacy Statement covers the personal information of individuals who are:

• Caterpillar candidates for employment or employees (meaning staff, personnel, and workers) or other persons currently or formerly employed to perform work for Caterpillar, including temporary employees (collectively, “employees”);
• Associated with Caterpillar’s customers, including dealers, dealers’ customers, distributors, distributors’ customers, direct sale customers, sales representatives and other resellers (collectively, “customers”); and
• Associated with suppliers of Caterpillar, such as suppliers’ employees (temporary workers, staff, personnel, and contractors, etc.) (collectively, “suppliers”).

In this Privacy Statement, the term “processing” means any activity performed on personal information, including, for example, collecting, storing, modifying, transferring or otherwise using it. Additionally, this Privacy Statement does not apply to other information (non-Personal Information) that Caterpillar may collect or otherwise process. For more information on other information that Caterpillar may collect or otherwise process, please see Caterpillar’s Data Governance Statement.

In addition to this Privacy Statement, some Caterpillar systems, applications, and processes may contain their own privacy notices, which provide additional details about what specific personal information is collected and how it is stored, used, and transferred.

Certain jurisdictions may prohibit or limit the collection, use or sharing of specific categories of personal information; accordingly, this Privacy Statement describing our practices may be limited by those laws and/or further clarified in any country-specific appendices applicable to you and attached to this Privacy Statement. When in conflict with this Privacy Statement, those appendices control.

For purposes of this Privacy Statement, personal information is any information about a specific individual or that identifies or may identify a specific individual. In other words, it is any piece of information than can be linked to you. Certain jurisdictions may prohibit or limit the collection of specific categories of personal information. Subject to local law and any attached appendices, examples of personal information that we may collect include, but are not limited to:

• Contact Information (e.g., name, address, telephone number, emergency contact(s) information);
• Social Security Number or other national/taxpayer identification numbers;
• Identification and Verification Information (e.g., photographs, driver’s license, passport, other proofs of identity);
• Information Security Data (e.g., communications created, stored or transmitted by a person using Caterpillar’s information technology or communications equipment);
• Information to fulfill items such as, but not limited to, communications, contracts, purchase orders, payments, and receivables; and
• Other information required to comply with applicable laws, including valid search warrants, subpoenas, or court orders.

Different categories of persons may be subject to additional collection of personal information, including but not limited to:

Customers:

• Business Contact Information (e.g., company name, address, telephone number);
• Individual Representative Contact Information: (e.g., name, address, telephone number, email address);
• Billing Information (e.g., financial account data, invoices, receipts);
• Client Relationship Management Information (e.g., information necessary to populate a customer’s profile or to facilitate marketing automation);
• Repair Information (e.g., repair needs and status);
• Warranty Information (e.g., purchase history, extended warranties); and
• Customer Satisfaction Information.

Caterpillar may receive equipment information that is personally identifiable by another party, e.g., the equipment owner, but in most instances, Caterpillar will not be the controller of that information.

Employees:

• Background Information (e.g., birth date, marital status, dependent information, ethnicity and/or nationality);
• Residency Information (e.g., work permit status);
• Financial Account Information;
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues);
• Background Check Information (e.g., credit and criminal background checks, drug and alcohol testing);
• Health Information (e.g., prescription records, benefit claims, and the Explanation of Benefits sent in connection with claims);
• Biometric Information (e.g., thumbprints);
• Trade Union affiliation;
• Automotive Information (e.g., driving history, vehicle registration, driver’s license number);
• Professional Qualifications Information (e.g., work experience, education); and
• Employment-related Information (e.g., work history, new hire forms, skills, education and training, performance appraisals, goals, attendance, work absences, vacation entitlement and requests, compensation history, workplace injury and illness reporting, disciplinary issues, and grievances).

Suppliers:

• Residency Information (e.g., work permit status);
• Financial Account Information;
• Background Information (e.g. due diligence)
• Professional Qualifications Information (e.g., work experience, education);
• Reference Information (e.g., letters of recommendation or reference, or reports provided by former employers or colleagues); and
• Biometric Information (e.g., thumbprints).

Depending on the applicable local law, some personal information collected by Caterpillar may be considered “sensitive personal information” (i.e., personal information subject to additional protections).

Additionally, in some cases, such as where you are the sole proprietor of a business, information about your company may be deemed personal information. This could include business information (e.g., office address), financial account information (e.g., bank account information, trade references, financial statements), assets (e.g., property ownership), credit rating, tax identification, and diversity classification.

Caterpillar may use anonymized (or de-identified information), that was derived from personal information, but in its anonymized form cannot be identified with a specific individual. This de-identified information is not considered personal information for purposes of this Privacy Statement and is not covered by this Privacy Statement. However, if such information is used or formatted in such a way that it is possible for that information to be identified with a specific individual, then it will be considered personal information as appropriate.

Because Caterpillar operates a global business, we may need to transfer your personal information to different jurisdictions for our business purposes. Caterpillar may transfer personal information to countries or jurisdictions that may not legally mandate the same level of data protection as the jurisdiction in which that personal information was collected. This Privacy Statement applies to all Caterpillar operations and their data processing activities and Caterpillar has entered into data transfer agreements with its affiliates worldwide to protect personal information.

Caterpillar only shares personal information with others in a manner consistent with this Privacy Statement, for the purposes stated above, when required by law, or with your consent. Information transfers to third parties will generally be transfers to third-party processors for those purposes consistent with this Privacy Statement. In addition, Caterpillar may transfer personal information to third-party data controllers as required by law, with your consent, or with approval from a relevant authority. In some jurisdictions, transfer of specifically delineated categories of data or transfer to certain third parties may require explicit consent from you. In all instances, the transfer of personal information is subject to local law and the attached appendices.

When Caterpillar shares personal information with third parties that process the personal information on Caterpillar’s behalf (e.g., contractors, consultants), Caterpillar takes reasonable steps to require such recipients to protect personal information in accordance with applicable laws. Examples of third parties with whom we may share information for any of these purposes include:

• Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services;
• Law enforcement or other government agencies (when required by law; authorized by the customer; to protect Caterpillar, a person or property; and to support our business, such as in applications for government grants);
• Subsidiaries, affiliates and other entities controlled by Caterpillar;
• Other third-party service providers that process personal information on behalf of Caterpillar;
• An acquiring entity (or an entity that is interested in acquiring) in the event that Caterpillar divests (or is considering divesting) a portion of its business; and
• (Employees only) Vendors providing medical or financial planning services to employees.

Caterpillar takes steps to maintain the accuracy and completeness of personal information. You may request and will receive reasonable access to the personal information you have provided to Caterpillar and have an opportunity to correct it if necessary. Caterpillar procedures grant you access to your personal information and enable the exercise of other rights that may be available to you under applicable local law.

Unless prohibited by local law or, in some cases, as mandated by local law, your right to access your personal information may be limited. Examples for why your access may be limited include:

• The request relates to legal advice and proceedings;
• A legal privilege may be claimed regarding the subject matter of the information;
• The personal information also includes the personal information of a third party who has not consented to disclosure and whose privacy would be affected by any such disclosure;
• The request is insufficiently detailed or has already been responded to;
• The request is frivolous or vexatious; or
• (Employees only) The information could disclose a confidential reference.

Caterpillar will consider local laws when reviewing requests to access or alter personal information held by Caterpillar.

If you are a customer, please contact the person representing Caterpillar to whom you have given your personal information for the proper procedure for obtaining access to your personal information.

If you are an employee, please contact your local, regional or corporate Human Resources representative for the proper procedure for obtaining access to your personal information. Upon request, and after providing satisfactory proof of identity and any additional requirements established by applicable local law, you will be given access to your personal information that you have a right to review and, if appropriate, the option to copy, modify, delete, or contest that personal information in Caterpillar’s systems.

If you are a supplier, you may contact the individual at your organization who is responsible for the Caterpillar relationship and who maintains a Corporate Web Security Identification (CWS ID) and/or has access to the Supplier Data Management Application (e.g. Supplier Connect) for “self-service” access.

For more specific information regarding rights under the General Data Protection Regulations (“GDPR”); please see Appendix 1 and/or Appendix 2 as applicable.  For more specific information regarding rights under the California Consumer Privacy Act (CCPA); please see Appendix 4 of this document.