Machine Operator Privacy Policy

This Privacy Policy governs the processing of personal data which takes place when operators operate Komatsu Forest machines equipped with software-based systems that allow the wireless monitoring of Komatsu Forest machines, as described on komatsuforest.com from time to time (hereinafter referred to as “Smart Forestry” or the “Services”).

The Services are globally managed and maintained by Komatsu Forest AB, a Swedish corporation with registration number 556079-5949, having its principal place of business in Umeå, Sweden (“Komatsu Forest”). Komatsu Forest is a wholly-owned subsidiary of Komatsu Limited, a Japanese corporation having its principal place of business at no. 3-6, Akasaka 2-Chome, Minato-Ku, Tokyo, Japan (“Komatsu Japan”).

1. Who is responsible?

   The owner of the machine or your employer (when your employer is not the owner) is the data controller and responsible for most of the processing of your personal data through Smart Forestry, as detailed in Section 5 below. The data controller has engaged Komatsu Forest as a data processor under a separate data processing agreement.

   For certain limited processing activities, performed as detailed in the second table of Section 5 below, Komatsu Forest is the data controller.

2. Who should you contact?

   If you have any concerns or questions about the data processing in Smart Forestry, please direct your questions and requests regarding the processing of your personal data (i.e. storage, collection, transfer etc. of all information that relates to you as operator) to your employer (if you are an employee) or your customer (if you are an independent contractor). If you are unsure who to contact, please send an e-mail to Komatsu Forest at gdpr@komatsuforest.com, stating your full name, function title and entity you work for, and we will liaise between involved entities to ensure that your questions, requests and rights regarding the processing of your personal data are given due regard.

3. What sort of personal data is processed?

   When you use a machine equipped with Smart Forestry, or administrate/manage the Services, the following types of personal data may be collected and processed:

   • personal identification data (“Operator Data”), including
     • name;
     • employee ID or user-ID;
     • current employment (e.g. function title and employer details);
     • e-mail address;
     • phone number;
     • physical address;
   • machine and production data (“Machine Data”), including
     • the use and operation of the machine;
     • machine location and position;
     • usage times and statistics;
     • error codes and frequency of those codes.

   Please note that Machine Data may include information about your use of the machine such as the position and time for your usage and your work efficiency.

4. How is your personal data processed?

   Your personal data (Operator Data and Machine Data) is automatically obtained from the machines when you operate them and thereafter processed by Komatsu Forest on the behalf of the owner of the machine (your employer or customer) with the main purpose to convey information about the production and operation of the machine and to streamline the use of the machine (see below 5). In some cases, pseudonymized data may be disclosed to Komatsu Forest, its distributors and dealers and authorities for processing on their own purposes.

5. Why is your personal data processed?

   When you use Komatsu Forest machines equipped with Smart Forestry, your employer (if you are an employee) or your customer (if you are an independent contractor) process your personal data in Smart Forestry for the following purposes:

   Why your personal data is processed	Personal data processed	Lawful Basis for Processing	Recipients	Retention Period
   (a) To measure, report and optimize the operation of the machine, such as production statistics, machine usage and location, operator performance and handling of diagnostic.	Operator Data and Machine Data	Necessary for legitimate interests of the owner of the machine or your employer, typically including to allow optimal production planning and provide efficient and competitive services to the owner’s/employer’s customers.	Komatsu Forest and its subcontractors, distributors, workshops or dealers authorized by Komatsu Forest or its Affiliates to offer the Service (“Approved Sources”), and principals of your employer (or your customer, if you are an independent contractor), such as a customer (landowners, forest companies etc.), a parent company or other third-party principals instructed and approved by your employer (or your customer, if you are an independent contractor) (“Approved Principals”).	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (b) To optimize jobsite layout, machine resource allocation and driving routes	Operator Data and Machine Data	Necessary for legitimate interests of the owner of the machine or your employer, typically including to allow optimal production planning and provide efficient services to the owner’s/employer’s customers.	Komatsu Forest including Approved Sources and Approved Principals.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (d) To improve jobsite safety and efficiency, such as ensuring proper working distance and machine resource planning.	Operator Data and Machine Data	Necessary for legitimate interests of the owner of the machine or your employer, typically to ensure a safe and secure working environment.	Komatsu Forest including Approved Sources.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (e) Where applicable, to follow-up on rental agreements	Operator Data and Machine Data	Necessary for legitimate interests of the owner of the machine or your employer, typically to minimise the disruption in providing its services.	Komatsu Forest including Approved Sources.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (f) To enable distributors and dealers to provide appropriate services and products for maintenance and educational purposes	Operator Data and Machine Data	Necessary for legitimate interests of the owner of the machine or your employer, typically including to provide efficient and competitive services to the owner’s/employer’s customers.	Komatsu Forest distributors or dealers from which your employer (or your customer, if you are an independent contractor) have purchased or enquired about Komatsu Forest machines, products or services.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (g) To comply with a legitimate request from law enforcement or other authorities	Operator Data and Machine Data	Necessary to comply with legal obligations.	Governmental, judicial and other competent bodies in case of a justified yet legally binding request.	The personal data are only processed for as long as needed to achieve the purpose. It will be deleted or de-identified when they are no longer necessary for such purpose.

   Please note that your employer can also use Smart Forestry to process your personal data for other purposes, such as to evaluate your performance as employee as well as for other purposes, but this is entirely between you and your employer. Komatsu Forest will not monitor the Services for work performance purposes and disclaims any and all potential responsibility or liability for such processing operations.

   Thereto, Komatsu Forest will process your personal data for the following limited purposes:

   Why your personal data is processed	Personal data processed	Lawful Basis for Processing	Recipients	Retention Period
   (h) To enable Komatsu Forest to provide support services	Machine Data and Operator Data	Necessary for the legitimate interest of Komatsu Forest, including; handling warranty claims and provisioning of support services; and creating refined data on aggregated level in order to provide and offer new insights, performance benchmarking data and other statistics or analytics to Komatsu Forest customers.	Komatsu Forest’s service providers who help Komatsu Forest to provide Smart Forestry and/or companies within the Komatsu group of companies, including Komatsu Japan.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.
   (i) To enable Komatsu Forest to improve Komatsu Forest machines, Smart Forestry and associated services.	Machine Data and Operator Data	Necessary for the legitimate interest of Komatsu Forest, including; creating and improving training materials for Smart Forestry, Komatsu Forest machines and services; the need to be able to improve Smart Forestry, Komatsu Forest machines and services; and creating refined data on aggregated level in order to provide and offer new insights, performance benchmarking data and other statistics.	Komatsu Forest’s service providers who help Komatsu Forest to provide Smart Forestry and/or companies within the Komatsu group of companies, including Komatsu Japan.	Personal data retained for such purpose is deleted 180 days after the Smart Forestry account to which the data is connected has been terminated.

6. Where is your personal data stored?

   Your personal data is stored in Sweden by Komatsu Forest. Your personal data may occasionally be transferred to Japan, based on the adequacy decision between EU and Japan, see Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.

7. How long will your personal data be stored?

   Your personal data are only processed to achieve the purposes listed in section 5 above. The personal data will be deleted or de-identified when they are no longer necessary for the purposes outlined in the purpose for processing in accordance with section 5 above, unless there is:

   • an overriding interest of Komatsu Forest, Komatsu Japan or any other third party in keeping your personal data identifiable;
   • a legal or regulatory obligation or a judicial or administrative order that prevents us from deletions or de-identification.
8. Which rights do you have with regard to the processing of your personal data?

   You have the right to request access to all personal data processed in Smart Forestry insofar it pertains to you and information on how your data is processed. You can exercise this right by contacting your employer (or customer, if you are an independent contractor).

   You have the right to ask that any personal data pertaining to you which are inaccurate, are corrected free of charge. Some personal data you can correct yourself if you have access to the Smart Forestry web portal. If a request for correction is submitted, such request must be accompanied of proof of the flawed nature of the data for which correction is asked.

   You have the right to request that personal data pertaining to you will be deleted if the data are no longer required in light of the purposes outlined above.

   You may also ask that we limit the processing of your personal data if and when (a) you contest the accuracy of that data, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes which are outlined above, but you need them to defend yourself in judicial proceedings.

   You have the right to object to the processing of your personal data for the purposes in section 5, but you are required to explain your particular circumstances on which your request for opposition is based.

   If you wish to submit a request to exercise one or more of the rights listed in this section, you shall contact your employer, if it concerns processing activities carried out for the purposes listed in the first table of section 5. If you have any complaint regarding the processing of your personal data carried out for the purposes listed in the second table of section 5, you shall contact Komatsu Forest via e-mail to gdpr@komatsuforest.com. If you are unsure who to contact, please send an e-mail to Komatsu Forest stating your full name, function title and entity you work for, and we will liaise between involved entities to ensure that your request are given due regard.

   An e-mail requesting to exercise a right will not be construed as consent with the processing of your personal data beyond what is required for handling your request. Such request should state and specify which right you wish to exercise and the reasons for it, if such is required.

   You may file a complaint with the competent data protection authority in your EU jurisdiction.