STIHL Digital Platform and STIHL Solutions Privacy Policy

As at: 25.11.2022 Market: United Kingdom

We are pleased to inform you about the processing of your personal data in this Privacy Policy. Below,
you will find information on how we process your personal data, the reasons why we process your
personal data, and the data subject rights you have in this regard.
If you would like further information not contained in this Privacy Policy, you can contact us and our Data
Protection Officer at any time via the contact details stated in section 2 of this Privacy Policy.

1 PRIVACY POLICY SCOPE

In this Privacy Policy, we will inform you about the processing of your personal data in
connection with the STIHL Digital Platform and the applications and services offered on the
STIHL Digital Platform ("Solutions"). You can access our Solutions via the STIHL Digital
Platform. To use the STIHL Digital Platform and Solutions, you first need to register and create
a user account ("STIHL Account").
In order for you to obtain relevant information quickly and clearly, we have set this Privacy Policy
out into individual chapters. We will inform you about the processing of your personal data (and
in addition to the relevant processing as set out below) in connection with the STIHL Digital
Platform and the Solutions as follows:
• STIHL Digital Platform: For information about the processing associated with the access
and usage of the STIHL Digital Platform, please refer to section 4 of this Privacy Policy
• STIHL Account: For information about the processing associated with your STIHL
account, please refer to section 5 of this Privacy Policy.
• STIHL connected: For information about the processing associated with STIHL
connected please refer to section 6 of this Privacy Policy.
In this Privacy Policy, we inform you about the processing of your personal data in line with the
requirements of the European General Data Protection Regulation (EU) 2016/679 of the
European Parliament and of the Council) as transposed into United Kingdom national law by
operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the
Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit)
Regulations 2019 (“UK GDPR”).
We will inform you about the processing of your personal data relating to the web addresses
(Uniform Resource Locator, "URL") you access. Should you access the STIHL Digital Platform
or the Solutions via a URL that is intended to serve a different country and its legal requirements
(i.e. you, as an example, instead of accessing the STIHL URL ending in “.co.uk”, access a STIHL
URL ending in “.de”) may end up not being informed in accordance with applicable local legal
requirements. For data protection reasons, we do not determine your place of residence
("localisation") to determine the law applicable to you.

2 CONTROLLER AND DATA PROTECTION OFFICER

2.1 Controller

The Controller under data protection law decides on the purposes and means of processing
your personal data and ensures compliance with the data protection regulations. If multiple
controllers decide together the purposes and means of processing, these controllers are jointly
responsible for the processing, which is referred to joint controllership.
The following joint controllers process your personal data in connection with the STIHL Digital Platform and the Solutions:

STIHL direct GmbH ("STIHL direct") Postal address: Badstr. 115, 71336 Waiblingen, Germany (a) Email: enquiries@stihl.co.uk District Court of Stuttgart, HRB 773503, VAT ID No. DE329143527

and
ANDREAS STIHL AG & Co. KG ("ANDREAS STIHL") Postal address: Badstr. 115, 71336 Waiblingen, Germany Email: enquiries@stihl.co.uk Limited partnership: District Court of Stuttgart, HRA 260269 STIHL Aktiengesellschaft: District Court of Stuttgart, HRB 263722 VAT ID No. DE147330096

(together "we", "us").

We have an agreement in place with one another relating to our joint processing of your personal
data.
We may also share your personal data with companies who are part of the STIHL Group, and
that are not part of the STIHL Group. These companies may process your personal data either
as independent controllers or as our processors

2.2 Data Protection Officer

STIHL direct and ANDREAS STIHL have a joint Data Protection Officer. You can reach the Data
Protection Officer by post at the addresses specified above for the controllers, addressed to "zu
Hd. Abteilung Datenschutz" or email to privacy_dpo@stihl.com.

3 GENERAL INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

3.1 Processing of your personal data

When we use the term “personal data” in this Privacy Policy, we mean all information that relates
to you.
Personal data includes, for example, your name, email address or postal address. Your personal
data also includes all data that is linked or relates to you, such as data that will be processed
when you use the Solutions. Data that does not relate to you we shall refer to as non-personal
or anonymous data. The data protection regulations and this Privacy Policy do not apply to such
data.
For example, by processing your personal data, we mean its collection, storage or erasure.

3.2 Legal basis for processing (overview)

We process your personal data only if we can base the processing on a legal basis or if such is
lawful in accordance with the applicable data protection regulations, i.e. that the processing is
permissible within the scope of the law. In the context of the UK GDPR, we base the processing
of your personal data for the most part on the following legal bases:
• The processing of your personal data is necessary for the fulfilment of a contract with
you or for the implementation of pre-contractual measures that take place at your
request (Article 6 (1) (b) UK GDPR).
• You have given us your clear consent to the processing of your personal data for one
or more specific purposes (Article 6 (1) (a) UK GDPR).
• The processing of your personal data is necessary to fulfil a legal obligation (Article 6
(1) (c) UK GDPR).
• The processing is necessary for the purposes of the legitimate interests pursued by us
or by a third party, except where such interests are overridden by the interests or
fundamental rights and freedoms of you which require protection of your personal data
(Article 6 (1) (f) UK GDPR).
Further information on the processing we undertake and the relevant lawful basis on which we
process your personal data, can be found below in this Privacy Policy.

3.3 Personal data we process

We process the personal data that you provide to us, that we collect (automatically), and that
we receive from third parties.
You are not obligated to provide us with your personal data. However, the processing of certain
personal data may be necessary to enable us to offer you the STIHL Digital Platform and the
Solutions.
Personal data you provide to us
We process the personal data you provide to us. For example, when you call or contact us and
provide us with certain personal data in this way. You can provide us with further personal data
when you select certain settings or configure a Solution according to your needs. We collect
and process this data to enable you to use the STIHL Digital Platform and Solutions. If you do
not provide us with certain information, the use or functionality of the STIHL Digital Business
Platform and Solutions may in part stop or be impaired.
Personal data we collect
We collect certain personal data automatically and process it when you use the STIHL Digital
Platform and the Solutions. This includes, for example, data such as your IP address, certain
login data and data that will be processed so that we can technically provide you with the STIHL
Digital Platform and the Solutions.
Personal data we receive from third parties
In some cases, we receive your personal data from indirect sources – i.e. not directly from you.
This may be the case, for example, if personal data about you is provided to us by third parties.
We work with companies that provide services to us and who in turn provide us with personal
data about you. These include, for example, payment service providers or providers of “app
stores” through which you can purchase our Solutions.

4 GENERAL PROCESSING - STIHL DIGITAL PLATFORM

4.1 Visiting the STIHL Digital Platform website

When accessing our website, the browser used on your device automatically sends information
to the server of our website and temporarily saves it in a ‘log file’.
If you would like to be informed about the cookies used by us on our website, you can find more
information here (https://app.stihl.com/en-gb/legal/cookie-notice).

Categories of personal data
The following information will be processed when the website is accessed:
• The IP address of the requesting Internet-enabled device;
• The date and time, and time of access;
• The name and URL of the retrieved file;
• The website/application from which access was made (referrer URL); and
• The browser you are using and, if applicable, the operating system of your Internetenabled computer and the name of your access provider.

Purpose
The processing of your personal data serves the following purpose(s):
• ensuring a smooth connection;
• ensuring a comfortable use of our website/application; and
• evaluating system security and stability.

Legal basis
The legal bases we rely on for the processing of your personal data are as follows:
• The website is accessed during the initiation or execution of a contract.
We process your personal data based on Article 6 (1) (b) UK GDPR.
• The processing of your personal data is necessary to enable you to access the website
and to ensure the performance, consistent functionality and security of our website and
systems.
We process your personal data based on Article 6 (1) (f) UK GDPR.
It is in our legitimate interest to ensure the performance, consistent functionality and
security of our website and systems.

4.2 Support and Communication

If you have any questions or if you cannot use STIHL Digital Platform and the Solutions as we
have described, you may contact us at any time by email, post, telephone, via contact forms or
by other means. We shall usually respond to you through the medium through which you
initiated contact.
In certain cases, we shall contact you independently, in particular to provide you with important
information about the STIHL Digital Platform and the Solutions. This is usually done by email.
Should you subscribe to the STIHL Group's newsletter, then we shall provide you with further
information regarding the processing of your personal data in relation to this subscription.

Categories of personal data
The following personal data will be processed when communicating with you:
• your contact details such as telephone number or email address;
• any personal data as part of communicating with you, including, where applicable,
telephone conversations with you;
• data relating to your request or concerns, such as the subject of your request or our
communication with you; and
• the data necessary to clarify your request.

Purpose
The processing of your personal data serves the following purpose(s):
• communicating with you when you have raised questions with us about the STIHL
Digital Platform or the Solutions, with a request for support or with other concerns;
• handling and responding to your enquiries and concerns;
• communicating with you outside of enquiries and concerns, for example, for information
purposes or for the fulfilment of legal or contractual obligations;
• should we record telephone calls, this is done for quality assurance and training
purposes; and
• improving our support.

Legal basis
When we communicate with you, we rely upon different legal bases, depending on the
background of the communication. The following shall apply:
• The communication with you and our support and performances within the scope of the
support are required to fulfil the contract for STIHL Digital Platform or the Solutions or
to conclude a contract for the use of STIHL Digital Platform or Solutions.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.
• Communication with you is necessary to ensure the security and functionality of the
STIHL Digital Platform or Solutions. This also means that we will further develop the
STIHL Digital Platform or Solutions based on your feedback and experience. If
necessary, we will ask for your opinion and assessment of our offers and services.
We base the processing on the legal basis of Article 6 (1) (f) UK GDPR.
It is in our legitimate interest to further develop our offers and services for you and to
improve your usage experience of the STIHL Digital Platform and Solutions.
• We provide you with certain support services outside of an existing contractual
relationship.
We base the processing in connection with our support, which we provide to you outside
of an existing contractual relationship, on the legal basis of Article 6 (1) (f) UK GDPR.
We have a legitimate interest in assisting you with questions about our offers and
services and ensuring the satisfaction of our (former and future) customers.
• For certain processing of your personal data, we will obtain your consent in accordance
with Article 6 (1) (a) UK GDPR, to the extent this is necessary.
This applies in particular to the recording of telephone calls.

4.3 Product development and statistical analysis

We process certain personal data in order to improve and further develop the STIHL Digital
Platform, the Solutions and other offers and services (or our support). In particular, this relates
to data on your use of the STIHL Digital Platform and the Solutions as well as data related to,
among other things, the properties, security and quality of our offerings and services.
As far as possible, the data will be pseudonymised or anonymised prior to processing for product
development and statistical evaluation. If the data is anonymised, it is no longer personal data.

Categories of personal data
The following information is processed in the context of product development and statistical
analysis:
• data on the use of STIHL Digital Platform and Solutions;
• data on the properties, security and quality of the STIHL Digital Platform and Solutions;
and
• other information we have, for example, from support requests received from you.

Purpose
The processing of your personal data serves the following purpose or purposes:
• improvement and further development of the STIHL Digital Platform and Solutions;
• product development, including artificial intelligence (machine learning);
• market research; and
• ensuring the security and quality of the STIHL Digital Platform and Solutions.

Legal basis
We base the processing of your data on the following legal basis:
• The processing is necessary so that we can improve and develop our products.
We base the processing on the legal basis of Article 6 (1) (f) UK GDPR.
We have a legitimate interest in the improvement and further development of the STIHL
Digital Platform, the Solutions and other offers and services offered by us and the STIHL
Group as well as in guaranteeing the security and quality of STIHL Digital Platform and
Solutions.

5 YOUR STIHL ACCOUNT ON THE STIHL DIGITAL PLATFORM

5.1 Register your STIHL Account

The registration of a STIHL Account is necessary for you to use the STIHL Digital Platform, the
Solutions and other offerings and services of the STIHL Group. The STIHL Account is your user
account with which you log in after registration with the STIHL Digital Platform, the Solutions
and other offers and services of the STIHL Group.
If the information provided by you during registration changes, you can change such information
at any time on the STIHL Digital Platform, if this is provided for.
As part of the registration process, we will inform you which information is required for
registration and which is voluntary.

Categories of personal data
The following information is processed when registering a STIHL Account:
• first name, surname, title, email address, set password, date of birth;
• contact and address data;
• your country and language;
• date and time of registration; and
• the version of the Terms of Use that you accept and the date and time of your consent.

Purpose
• Setting up and providing a STIHL Account as a user account to use the STIHL Digital
Platform, the Solutions and other offerings and services of the STIHL Group.

Legal basis
We base the processing of your data on the following legal basis:
• The processing of your personal data is necessary for setting up your STIHL Account
and making it permanently available to you as your user account for the STIHL Digital
Platform, Solutions and other offerings and services of the STIHL Group.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.
• The processing of your personal data, which is not necessary for setting up your STIHL
Account and of which you voluntarily inform us, yet is required, for example, so that we
can improve your experience with STIHL.
We base the processing on the legal basis of Article 6 (1) (f) UK GDPR.
It is in our legitimate interest to improve your usage experience of the STIHL Digital
Platform and Solutions.

5.2 Logging in with your STIHL Account with the STIHL Digital Platform and the Solutions

You use your STIHL Account to log into the STIHL Digital Platform, the Solutions and other
offerings and services of the STIHL Group.

Categories of personal data
The following information will be processed when logging in with the STIHL Account:
• Your STIHL Account;
• The password you have set for your STIHL Account.

Purpose
The processing of your personal data serves the following purpose or purposes:
• logging in and authentication with the STIHL Digital Platform, Solutions and other
offerings and services of the STIHL Group;
• access to the data stored by you with the STIHL Digital Platform, Solutions and other
offerings and services of the STIHL Group; and
• protecting your account and data from unauthorised access.

Legal basis
We base the processing of your personal data on the following legal basis:
• The processing of your personal data is necessary for enabling you to log into the STIHL
Digital Platform, the Solutions and other offerings and services of the STIHL Group.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.

5.3 Invitation to register a STIHL Account

You can be invited by existing users of STIHL Digital Platform or Solutions to the STIHL Digital
Platform and Solutions. If you are invited, you will receive an email from us with a link to register
a STIHL Account. If you decide to create a STIHL Account, the information the inviting user
provided about you may already be pre-populated in certain sections of account registration.
If you do not create a STIHL Account, we will delete the data about you, provided to us by the
inviting user.

Categories of personal data
The following information shall be processed in connection with the invitation:
• the first name, surname, title, email address provided by the inviting user;
• the country and language related to the inviting user; and
• date and time of invitation.

Purpose
The processing of your personal data serves the following purpose or purposes:
• The opportunity to invite you to the STIHL Digital Platform and Solutions.
• You can be invited to the STIHL Digital Platform and Solutions, among other things, so
that you can use certain functions linked to other users after you have created a STIHL
Account, for example within the framework of the Solutions. For example, you can
become a member of organisations or teams within the framework of Solutions.

Legal basis
We base the processing of your personal data on the following legal basis:
• The processing of your personal data is necessary to assist you in creating a STIHL
account, for example when a dealer sends you an invitation as part of the setup process
for a STIHL product.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.
• The processing of your personal data is necessary in order to be able to invite you to
the STIHL Digital Platform or the Solutions. This is a feature that we offer existing users
so that, for example, you can become a member of an organisation of the existing user
if you want to.
We base the processing on the legal basis of Article 6 (1) (f) UK GDPR.
It is in our legitimate interest to be able to offer this feature to our existing users and it
is in the legitimate interest of our users to be able to invite you, so that, for example,
you can become a member of the user's organisation.

6 PROCESSING YOUR PERSONAL DATA WITH THE STIHL CONNECTED SOLUTION

6.1 STIHL Smart Device - STIHL Smart Connector

STIHL Smart Connectors include the STIHL Smart Connector, the STIHL Smart Connector 2 A,
and all future generations of STIHL Smart Connectors.
If you do not connect your STIHL Smart Connector or several STIHL Smart Connectors to your
STIHL Account via the STIHL connected app or the STIHL connected box, STIHL will not
process data related to your STIHL Smart Connector and your device, which we assign to you.
In this case, we do not process any personal data from you.

6.2 STIHL Smart Device - STIHL Smart Batteries

STIHL Smart batteries include the generation 1 and 2 STIHL smart batteries, as well as all future
generations.
If you do not connect your STIHL Smart Batteries to your STIHL connected app or STIHL
connected box to your STIHL Account, STIHL will not process any data related to your STIHL
Smart Batteries, which we assign to you. In this case, we do not process any personal data from you.

6.3 STIHL Smart Device - STIHL connected box

The STIHL connected box transmits the operating data of your devices and data of the STIHL
Smart Batteries directly to STIHL via a LAN or WLAN network. A connection between your
STIHL Smart Connector or your STIHL Smart Battery and the STIHL connected app is not
required when using the STIHL connected box to transfer the data to STIHL, as the connection
can be established solely via the STIHL connected box. The data transmitted via the STIHL
connected box is immediately available in your STIHL connected app or your STIHL connected
portal after transmission.
If you have not configured the STIHL connected box via the STIHL connected portal and linked
it to a STIHL account, no data will be transmitted to us. In this case, we do not process any
personal data from you.

6.4 STIHL Smart Device - STIHL connected mobile box

With the STIHL connected mobile box, you do not need a LAN or WLAN network, because the
runtime and position data are transmitted via the mobile network or via Bluetooth® Low Energy
(BLE). For the use of the STIHL connected mobile box you need a Mini-SIM card with separate
mobile contract (not included in the scope of delivery).
In connection with the transmission of data over the mobile network of the mobile
telecommunications provider chosen by you, the processing of personal data by the mobile
telephony provider chosen by you occurs. Information on the processing of personal data in
connection with the transmission of data over the mobile network can be found regularly in the
Privacy Policy of your mobile provider.
If you have not configured the STIHL connected mobile box and linked it to a STIHL Account,
no data will be transmitted to us. In this case, we do not process any personal data from you.

6.5 STIHL connected app

If you connect your STIHL Smart Devices, such as your STIHL Smart Connector or your STIHL
Smart Batteries to the STIHL connected app and have logged in to the STIHL connected app
with your STIHL Account, data will be transmitted to us and processed by us.
In relation to the processing of your personal data in connection with the STIHL connected app,
we differentiate according to the functions of the STIHL connected app.

(a) Registering a STIHL Account and logging in to the STIHL connected app

With regard to the processing of your personal data in connection with the registration of a
STIHL Account and logging into the STIHL connected app, we refer to section 5 of this Privacy
Policy.

(b) Processing data of the Smart Connectors in the STIHL connected app

If you connect your STIHL Smart Connector or several STIHL Smart Connectors via the STIHL
connected app to your STIHL Account, we process data related to your STIHL Smart Connector
and your device, which we assign to you. In this case, we process personal data from you.

Categories of personal data
The following information is processed when connecting STIHL Smart Connectors to a device
and your STIHL connected app and linked to your STIHL Account:
• technical information of the STIHL Smart Connectors (e.g. Mac address, software
version);
• technical information of the connected machines (e.g. machine last seen, tool id);
• usage data of the connected machine (e.g. runtime, error event, servicing event);
• Runtime information and runtime analysis (only with STIHL Smart Connector 2 A); and
• date and time of data collection.

Purpose
The processing of your personal data serves the following purpose or purposes:
• identifying and ensuring the functionality of your STIHL Smart Connectors;
• ensuring adequate use of STIHL connected fleet management in relation to device
usage, reviewing operational readiness, (run-)time-based control of servicing
instructions; and
• ensuring adequate customer support.

Legal basis
• The processing of your personal data is necessary for enabling your use of the STIHL
connected app according to the features offered in connection with the STIHL Smart
Connectors.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.

(c) Processing of data from STIHL Smart Batteries in the STIHL connected app

If you connect your STIHL Smart Batteries to your STIHL Account via the STIHL connected app,
we process data related to your STIHL Smart Batteries, which we assign to you. In this case,
we process personal data from you.

Categories of personal data
When STIHL Smart Batteries are connected to your account, battery-specific usage data are
associated with your account. These data are:
• technical information of STIHL Smart Batteries;
• technical information of the connected machines;
• usage data of the connected battery; and
• date and time of data collection.

Purpose
The processing of your personal data serves the following purpose or purposes:
• identifying and ensuring the functionality of your STIHL Smart Batteries;
• ensuring adequate use of STIHL connected fleet management in relation to battery
usage, reviewing operational readiness, (run-) time-based evaluation possibility in
relation to battery usage; and
• ensuring adequate customer support.

Legal basis
• The processing of your personal data is necessary for enabling your use of the STIHL
connected app according to the features offered in connection with the STIHL Smart
Batteries.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.

(d) Nearby Function

If you are logged in with your STIHL Account in the STIHL connected app and are near STIHL
Smart Connectors or STIHL Smart Batteries, which you have assigned to your organisation,
these STIHL Smart Connectors or STIHL Smart Batteries will be displayed in the STIHL
connected app under the ‘Nearby Function’.
Data is not transmitted to us or processed by us as part of the Nearby Function. The following
explanations are therefore only intended to better understand the Nearby Function. If you have
any questions about the Nearby Function or specifically the processing of data in the context of
the Nearby Function, we are of course at your disposal.

Categories of personal data
The following information is processed in the context of the Nearby Function:
• location information of your smartphone (if enabled);
• designation of the STIHL Smart Connectors that are close to you and within range of
the Bluetooth® technology used; and
• dates and times of data transfer.

Purpose
The purpose of the processing of the data shall be for the purpose of:
• displaying the position of your STIHL Smart Connectors or Smart Batteries on a map;
and
• using the digital fleet management.

(e) Geo-position/ Location data

If you have activated this in your STIHL connected app, we process the data collected by the
STIHL Smart Connector or the STIHL Smart Battery linked to the geo-position of your connected
mobile device.
If you have linked your STIHL account to a STIHL Smart Connected Box, the STIHL connected
box location will be transmitted when the data of your STIHL Smart Connector are synchronised
• if you have stored them accordingly.
If you have activated this and linked your STIHL Account to a STIHL connected mobile box, the
STIHL connected mobile box location will be transmitted when the data of the STIHL connected
mobile box - and thus the data of the STIHL Smart Connectors connected to the STIHL Connect
• are synchronised.

Categories of personal data
The following information will be processed if you have activated or stored it accordingly:
• your location information based on the location of the mobile device you are linking;
• the location of your STIHL connected box;
• location information of your STIHL connected mobile box; and
• date and time of data transfer.

Purpose
The processing of your personal data serves the following purpose or purposes:
• displaying the position of your STIHL Smart Connectors or the STIHL connected
(mobile) box on a map; and
• using the digital fleet management.

Legal basis
• The processing of your geo-position/location data will only take place if you have
activated the corresponding function, have stored the corresponding data or ask us to
activate this function.
We base the processing on your consent according to the legal basis of Article 6 (1) (a)
UK GDPR.

(f) Your STIHL specialist retailer

If you have stored data for a STIHL specialist retailer for STIHL connected and have granted it
a corresponding permission in the STIHL connected portal, certain data will be transmitted to
the specialist retailer you have input.
At no time will images or personal notes, that you have stored in your STIHL Account or that
you have uploaded, be forwarded. By configuring the STIHL connected app and the STIHL
connected portal, we ensure that you always have transparency and control over the data
transmitted to the specialist retailers.
You also have the possibility to forward specific data, such as device-specific data, directly to
your specialist retailer by means of a contact form.

Categories of personal data
The following information will be processed:
• information regarding your STIHL Account; and
• usage data and events of STIHL Smart Devices filed with the specialist retailer
(depending on the rights you have granted to your STIHL specialist retailer).

Purpose
The processing of your personal data serves the following purpose or purposes:
• closer contact with your specialist retailer so that they can optimally support you with
service offers (e.g. in the case of repairs and servicing).

Legal basis
• The processing of your personal data is necessary, as far as you decide to input
specialist retailers, so that you can be supported by them in the best possible way. The
data provided to the specialist retailer is limited to what is necessary for this purpose
and you have control over whether you want to input a specialist retailer.
We base the processing on the legal basis of Article 6 (1) (f) UK GDPR.
It is in our legitimate interest and that of the specialist retailer that you are supported in
the best possible way with your STIHL products and that we meet your demands of
STIHL.

(g) Servicing Management

As part of servicing management, you can manage the servicing of the equipment you link. This
allows you to use the service intervals recommended by us or to define your own service
intervals. If you arrange for the servicing of a device or refer to you for servicing-related data,
this information will be linked to your STIHL Account.

Categories of personal data
The following information will be processed:
• customised service intervals; and
• date and time of completion of a service.

Purpose
The processing of your personal data serves the following purpose or purposes:
• documentation related to digital machine file (history of all events that occurred).

Legal basis
• The processing of your personal data is necessary for enabling your use of the servicing
function.
We base the processing on the legal basis of Article 6 (1) (b) UK GDPR.

(h) Error Analysis and Tracking

In addition to processing your personal data to ensure the security and quality of our offerings
and services, certain collected data will be transmitted to us as part of an extended error analysis
if you have given a corresponding consent in the STIHL connected app.
In addition, if you have agreed to an extended collection of the data in the context of the error
analysis, a precise error identification will be carried out.

Categories of personal data
The following information will be processed:
• information on the device used (e.g. smartphone);
• information on the location of use;
• error log data;
• usage analysis data; and
• date and time of data transfer.

Purpose
The processing of your personal data serves the following purpose or purposes:
• troubleshooting and ensuring support; and
• app usage analysis.

Legal basis
The processing of your personal data will only take place if you have given your consent.
• We base the processing on your consent according to the legal basis of Article 6 (1) (a)
UK GDPR.

6.6 STIHL connected portal

The STIHL connected portal offers you functions that go beyond the scope of the STIHL
connected app. Below we inform you about the processing of your personal data when using
these additional functions. Please take into account the preceding section on the processing of
your personal data within the STIHL connected app, which applies in an essentially comparable
way as to the same functions in the STIHL connected portal.

(a) Creating an organisation and inviting members (e.g. employees)

You can create an organisation in the STIHL connect portal, for example, for your company.
You can add members to this organisation, such as your employees.
Members are added by an invitation function. Further information on the processing of personal
data within the scope of the invitation function can also be found below and above under section
5.3.
The creation and management of an organisation always requires connection with a STIHL
Account that is used by you or another authorised person. The STIHL Account associated with
the organisation can be changed. For more information on how to manage your organisation
and grant rights within the organisation, see the STIHL Digital Platform Terms of Use in the
Special Part related to STIHL Connected.
If you have added a person you have invited to your organisation, you can also assign them to
a team within the organisation.
You also have the option to create teams without assigning members of the organisation to the
teams you create, but instead you can assign the STIHL Smart Devices you have stored to a
team.
Controller
The processing of the personal data of the members of your organisation is the responsibility of
the entity behind the organisation, for example a company as a legal entity or yourself. This
does not affect our responsibility, which is independent of and separate from your responsibility.

Categories of personal data
If the person you invite wants to join your organisation, that person must create a STIHL
Account. For the processing of the personal data in the context of the registration for a STIHL
Account, we refer to section 5 of this Privacy Policy.
The following information will also be processed:
• organisation to which you add the member;
• if applicable, information about the team to which you add the member; and
• data about the STIHL Smart Devices.

Purpose With this feature, we want to give you the opportunity to manage and group as a unit (team) the
usage of your STIHL Smart Devices in relation to the members of your organisation or
separately to the Smart Devices.

Legal basis
The processing of the data collected by the STIHL Smart Connectors and processed in the
STIHL connected portal or the STIHL connected app is in conformity with previous statements.
This shall apply in an essentially comparable way as to the processing of personal data in
connection with the use of the STIHL connected app portal by the members of your organisation.
Please note previous information on your responsibility for the processing of personal data of
the members of your organisation. If the members of your organisation are your employees, you
may have to take into consideration special legal requirements regarding the processing of their
personal data.

7 STORAGE PERIOD

As long as you use the STIHL Digital Platform and the Solutions or until you delete your STIHL
Account, we will process your personal data as it is necessary to provide you with the STIHL
Digital Platform and the Solutions you want. The storage period for your personal data depends
in particular on which of our Solutions and which of the features offered by the Solutions you
use.
In addition, the storage period depends on the category of personal data processed and the
purpose of the processing. Finally, we take into account legal retention periods, which may
obligate us to keep your data for a certain period of time. Accordingly, storage may take place
if this is provided for by the applicable regulations, laws or other provisions to which we are
subject.
In the event of a legal dispute, we will keep the personal data we need for our legal defence
until the final conclusion of the proceedings.
For more information on the storage period, please contact us via the contact details to be found
in this Privacy Policy under section 2.

8 RECIPIENTS OF YOUR PERSONAL DATA

8.1 Recipients within the STIHL Group

We share your personal data with other STIHL Group companies in certain cases. The
processing by these STIHL companies is carried out on our behalf or subject to our own
responsibility. If the processing is carried out on our behalf, a contract has been concluded
between us and the respective STIHL company for the processing of data within the meaning
of the UK GDPR.

8.2 Recipients outside the STIHL Group

(a) In addition to recipients of the STIHL Group, we share your personal data with our
partners, in relation to individual processing operations and taking into account the data
protection regulations. Our partners include service providers who process your
personal data on our behalf (as our data processors), and service providers who provide
services to us that may include processing your personal data as independent
controllers. In connection with the processing of your personal data, we use the
following categories of service providers:
• IT Service Providers (Data Hosting Providers);
• Support (Customer Support); and
• Lawyers, auditors and tax advisers.
(b) Third parties in case of a legal requirement. We also disclose your personal data if
disclosure is required by law or in the context of an investigation, regulatory
requirement, judicial proceeding, court order or legal process served on us, or to protect
the rights or safety of the STIHL Digital Platform and Solutions, STIHL Accounts, us or
the STIHL Group.
(c) Third parties in case of a corporate transaction. In addition, information about our
customers, including personal data, may be disclosed as part of any merger, sale,
transfer of our assets, acquisition, bankruptcy, or similar event.

9 TRANSMISSION OF YOUR PERSONAL DATA TO COUNTRIES OUTSIDE
THE EUROPEAN ECONOMIC AREA AND THE UNITED KINGDOM

Regardless of where your personal data are processed, the highest priority for us is that the
level of protection guaranteed by the UK GDPR is always ensured. If we pass on personal data
to recipients whose systems for processing your personal data or their subcontractors are
located outside the European Economic Area and/or, or if we transfer personal data to recipients
outside the European Economic Area and the United Kingdom, we comply with the requirements
of Chapter V of the UK GDPR.
Whenever we make transfers of your personal data, we ensure to implement appropriate
safeguards in accordance with applicable data protection laws. Whenever we make transfers of
your personal data, we ensure to implement appropriate safeguards in accordance with
applicable data protection laws, e.g. the International Data Transfer Addendum to the EU
Commission standard contractual clauses, relating to transfers to non-EEA countries without an
Adequacy Decision. You can ask us for an overview of the recipients in countries outside the
European Economic Area and the United Kingdom and information on the measures we have
taken to ensure the level of protection of the UK GDPR at any time via the contact details
specified under section 2 in this Privacy Policy.

10 YOUR DATA RIGHTS AND ASSERTING THEM

If you wish to assert your data rights as specified below, you can contact us at any time and
without any required form via the communication channels specified in this Privacy Policy. By
email and on the other communication channels, you can reach STIHL direct and the Data
Protection Officer of STIHL direct via the contact details specified under section 2 of this Privacy
Policy.

10.1 Right to information

You have the right to request confirmation as to whether or not your personal data will be
processed. When we process your personal data, you have a right to information about this
personal data and certain information required by law. For more information on your right to
information, see Art. 15 UK GDPR.

10.2 Right to rectification

You have the right to request the rectification of incorrect personal data concerning you without
delay. Taking into account the purposes of processing, you have the right to request the
completion of incomplete personal data. For more information on your right to rectification, see
Art. 16 UK GDPR.
We always strive to ensure the accuracy of your personal data. We therefore ask you to notify
us immediately of any changes to your data (such as changes in address), so that we can
ensure that your personal data is up-to-date.

10.3 Right to erasure

If the legal requirements are met, you may request us to erase your personal data immediately.
This shall be the case, in particular, where:
• your personal data will no longer be required for the purposes for which it was collected
or otherwise processed;
• the processing of your personal data is based on your consent, you revoke this consent
and we cannot base the processing on another legal basis;
• you have objected to the processing of your personal data on grounds relating to your
particular situation and there are no overriding grounds for the processing of your
personal data.
• if your personal data have been passed on to third parties and we are obligated to erase
your personal data, we will inform these third parties about the erasure, insofar as this
is required by law.
We would like to point out that your right to erasure is subject to restrictions. For example, we
may not erase any personal data that we have to keep further due to legal requirements. Data
that we need in order to assert, exercise or defend legal claims are also excluded from your
right to erasure. For more information on your right to erasure, see Art. 17 UK GDPR.

10.4 Right to restriction of processing

If the legal requirements are met, you may request a restriction on the processing of your
personal data. This is particularly the case where:
• the accuracy of your personal data is contested by you, the processing of your data will
be limited for a period that allows us to verify the accuracy of your personal data;
• the processing of your personal data is not lawfully carried out and you require a
restriction on the use of your personal data instead of the erasure of your personal data;
• we no longer need your personal data for the purposes of processing, but you need
these data for the establishment, exercise or defence of legal claims;
• you have objected to the processing of your personal data on grounds relating to your
particular situation, as long as it is not clear whether our legitimate grounds for
processing outweigh your grounds.
For more information on your right to restriction of processing, see Art. 18 UK GDPR.

10.5 Right to data portability

You have the right to receive the personal data you have provided us and which we process for
the fulfilment of the contract, on the basis of your consent or by automated procedures, in a
structured, customary and machine-readable format. You also have the right, in the event that
the aforementioned conditions are met, that we transmit these data directly to a third party,
insofar as this is technically feasible. For more information on your right to data portability, see
Art. 20 UK GDPR.

10.6 Withdrawal of consent

If you have given your consent to the processing of your personal data, you can revoke it at any
time with effect for the future. The lawfulness of the processing of your data up until revocation
remains unaffected.

10.7 Right to object to data protection authorities

If you consider that the processing of your personal data violates applicable data protection
laws, you may lodge a complaint with a data protection supervisory authority, in particular the
data protection supervisory authority at your location, place of work or place of alleged
infringement.

10.8 Right to object to processing

Right to object to the processing of your personal data during processing based on our legitimate interests

Insofar as we process data on the basis of a legitimate interest, you can object to the processing at any time for reasons that arise from your particular situation. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. We assume that, in the course of processing on the basis of a legitimate interest, we can normally prove such compelling legitimate grounds for protection, but we examine and evaluate each objection individually.

For more information on your right of objection, see Art. 21 UK GDPR

11 AMENDMENTS TO THIS PRIVACY POLICY

In this Privacy Policy, we will always keep you fully and completely informed about the
processing of your personal data in connection with the STIHL Digital Platform and the
Solutions. This requires that we update this Privacy Policy regularly, for example when we offer
new solutions on the STIHL Digital Platform. We therefore recommend that you consult this
Privacy Policy regularly.
Right to object to the processing of your personal data during processing based on
our legitimate interests
Insofar as we process data on the basis of a legitimate interest, you can object to the
processing at any time for reasons that arise from your particular situation. We will
no longer process your personal data unless we can demonstrate compelling
legitimate grounds for processing that override your interests, rights and freedoms,
or for the establishment, exercise or defence of legal claims. We assume that, in the
course of processing on the basis of a legitimate interest, we can normally prove such
compelling legitimate grounds for protection, but we examine and evaluate each
objection individually.
For more information on your right of objection, see Art. 21 UK GDPR.