The companies of the Avesco Group (hereinafter referred to as Avesco) respect your privacy and personal rights. Avesco takes the protection of your personal data, such as your name, date of birth, address, email address, or telephone number, very seriously. This privacy policy governs the processing of your personal data by Avesco. When handling this data, Avesco always complies with the relevant legal data protection regulations and the following principles.

Avesco's websites may contain links to other providers' websites. This privacy policy does not apply to the websites of other providers.

1. Definition of personal data and processing

"Personal data" is all information and details relating to an identified or identifiable person. An identifiable person is a natural person who can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (such as an email address, but under certain circumstances also an IP address) or one or more special characteristics which are an expression of the physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person.

"Processing" of personal data means any operation performed with or without the aid of automated processes, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of provision, alignment, or combination, restriction, erasure, or destruction.

2. Sources and types of personal data

Avesco processes personal data that you yourself provide to us in the context of business and contractual relationships or that we receive from the respective business and contractual partners in a permissible manner, for example, in the context of processing an inquiry or an order. Where applicable, we process additional personal data that we receive about you from publicly available sources (e.g., commercial registers, credit agencies, publications) in a permissible manner. 
Relevant personal data includes, in particular

Professional contact details and work and organizational data (e.g., first name, last name, title, gender, address, email address, telephone number)

Data on personal and professional circumstances and characteristics (e.g., job title, company affiliation, function in the company)

Further personal data, such as that obtained from the use of our website, is listed in section 8 for the use cases described there.

3. Basis for the processing of personal data

Avesco stores and processes your personal data to the extent necessary for the establishment, implementation, or termination of a contractual or quasi-contractual customer relationship. Other reasons for processing your personal data may be legal obligations of Avesco and the pursuit of Avesco's legitimate interests. These include, among other things, cooperation with business partners (customers, suppliers) and the efficient, pragmatic design of processes within the business relationship, in particular communication with designated contact persons.

Otherwise, Avesco will only process personal data with your prior consent. Your personal data will then be used only for the stated purpose and to the extent necessary to fulfill it.

4. Data avoidance and data minimization

When processing personal data, Avesco observes the principles of data avoidance and data minimization. This means that Avesco processes as little personal data as possible.

5. Rights of the data subject

In connection with the processing of your personal data, you have the following rights, provided there are no legal restrictions:

Right to information
You have the right to obtain information at any time about the personal data we process concerning you.

Right to rectification
You can request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to erasure
You have the right to request that we erase your personal data without delay. Possible reasons for this are:

The data is no longer necessary for the purposes for which it was collected or otherwise processed.

You withdraw your consent, and there is no other legal basis for the processing.

You object to the processing, and there are no overriding legitimate grounds for the processing.

The personal data has been processed unlawfully.

The deletion is necessary to comply with a legal obligation.

Please note that the right to erasure may be restricted in certain cases, e.g., if processing is necessary to comply with legal retention obligations or to assert, exercise, or defend legal claims.

Handling of backups: Data contained in backup copies cannot be deleted individually for technical reasons. However, these backups are used exclusively for recovery after system errors and are not reprocessed. The personal data contained therein is automatically overwritten or deleted after the respective retention periods have expired.

Right to restriction of processing
You may request the restriction of the processing of your personal data, e.g. if you dispute the accuracy of the data during the period of verification.

Right to data portability
You have the right to receive the personal data concerning you, which we process on the basis of your consent or for the performance of a contract, in a structured, commonly used and machine-readable format, or to have it transmitted to another controller. Currently, no data is fully automatically processed.

Right to object
You may object to the processing of personal data for advertising purposes, including the analysis of customer data or the transfer to third parties for advertising purposes, at any time without giving reasons. In addition, you have a general right to object. In this case, the objection to data processing must be justified.

Revocation of consent
If the processing of your data is based on consent, you can revoke this consent at any time with effect for the future, without affecting the legality of the processing carried out until the revocation.

Right to lodge a complaint
You also have the right to complain to the data protection supervisory authority responsible for you about the processing of your personal data. The competent data protection authorities in the countries where the companies of the Avesco Group are based are:
Austria: Austrian Data Protection Authority (Österreichische Datenschutzbehörde - DSB), data-protection-authority.gv.at 
Estonia: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon - AKI), www.aki.ee
Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi 
Latvia: Data State Inspectorate (Datu valsts inspekcija - DVI), www.dvi.gov.lv  
Lithuania: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija – VDAI), vdai.lrv.lt 
Switzerland: Federal Data Protection and Information Commissioner, www.edoeb.admin.ch

6. Third-party access to your personal data, transfer to third countries

The collection, processing, and use of personal data is carried out by Avesco itself and - unless Avesco has expressly excluded this - also by service providers commissioned by Avesco. In the latter case, Avesco will ensure that service providers comply with the relevant statutory data protection rules and the obligations set out in this privacy policy. Furthermore, Avesco will make data available to third parties, in particular government agencies, in accordance with official or legal requirements and legal disclosure obligations.

The processing of data in a third country (i.e., outside Switzerland, the European Union (EU), or the European Economic Area (EEA)) will only take place on the basis of special guarantees, such as the officially recognized determination of a level of data protection equivalent to that of the EU (e.g., for the USA through the Data Privacy Framework) or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

7. Data security

Avesco uses appropriate technical and organizational measures to protect your personal data from loss, alteration, destruction, theft, or unauthorized access. These security measures are continuously improved in line with technological developments.

Data communication with all Avesco websites is encrypted using HTTPS.

8. Information on various types of personal data processing

8.1 Use of our online services – websites and shops

8.1.1 Location of data processing, collection of access data, and log files

Our website, including the Cat Shop (see section 8.1.5), is hosted on dedicated servers at Hetzner Online GmbH, Gunzenhausen, Germany. Orders are transmitted to Avesco's ERP system in Switzerland for order processing.

Based on our legitimate interests (i.e., interest in the operation of our online offering and its analysis and optimization), our hosting partner or we collect data about every access to the server on which this service is located (so-called server log files). The access data includes the website accessed, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user's operating system, the referrer URL (the previously visited page), the IP address, and the requesting provider.

8.1.2 Cookies

Our website uses cookies, small files stored on the user's computer. There are necessary cookies, which are required for our website to function properly, and non-necessary cookies. Non-necessary cookies require your consent. Avesco uses a consent management system that requests your consent and allows you to manage it. You can therefore revoke your consent at any time. To do so, click on the paperclip icon at the bottom of our website. There you will also find further information about cookies and the types of cookies used.

8.1.3 References and hyperlinks

The use of hyperlinks on Avesco's website may cause you to leave Avesco's network and systems. Avesco accepts no responsibility for the content, accuracy, or functionality of third-party websites. Links are provided in good faith, and Avesco accepts no responsibility for changes to third-party websites to which we link. The inclusion of a link to other websites does not constitute a recommendation by Avesco. We strongly advise you to carefully review the legal and privacy information applicable to the other websites you visit.

8.1.4 Third parties, services, and tracking

We use the services listed below to optimize the user experience when using our website and for marketing purposes.

Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited (https://www.google.de/contact/impressum.html), to evaluate user behavior on our website and optimize our online offering. Processing is based on your consent, which we obtain via the consent management tool (see section 8.1.2).

The data processed includes information about visitor behavior on this website, e.g., how often users visit, which pages they visit, and which other websites they visited before coming to this website. Google Analytics only collects the IP address assigned to you on the day you visit this website, but not your name or other identifying information. Furthermore, Google Analytics anonymizes IP addresses before they are stored. In addition, we may combine Google Analytics data with information from first-party and third-party providers that may contain personal data.

Google Analytics creates a persistent cookie in your web browser to identify you as a unique user the next time you visit this website. This cookie can only be used by Google.
You can revoke your consent to Google Analytics at any time: via our consent management tool, by installing the browser add-on to deactivate Analytics (https://tools.google.com/dlpage/gaoptout), or by blocking cookies in your browser.

The data is transferred to Google servers, processed, and stored. This may involve the transfer of personal data to Google LLC, based in the USA. This is done in accordance with the Data Privacy Framework, under which Google is certified (see www.dataprivacyframework.gov/list).

Further information on data processing by Google can be found in Google's privacy policy (https://policies.google.com/privacy) and in the help section (https://support.google.com/analytics/answer/12017362).

Google Ads, conversion measurement, and remarketing
We use Google Ads, an online advertising service provided by Google Ireland Limited (https://www.google.de/contact/impressum.html), which enables us to place ads on the Google advertising network (e.g., in search results, videos, and websites) and measure their success. The use of Google Ads is based on your consent, which we obtain via our consent management tool (see section 8.1.2). In this context, we use conversion tracking and remarketing.

When you click on an ad placed by Google, a cookie is set for Google Ads conversion tracking. These cookies enable Google to recognize users across different websites and compile conversion statistics for ad campaigns. Processed data may include: anonymized user ID, IP address, website usage, click behavior, technical browser and device data.
With Google Ads Remarketing, we can display personalized advertising to visitors to our website. Google uses cookies to recognize which pages you have visited and to deliver relevant advertising to you on other websites. Cookies and other tracking technologies are used for this purpose.

It is possible that personal data may be transferred to Google LLC servers in the USA. This is done in accordance with the Data Privacy Framework under which Google is certified (see www.dataprivacyframework.gov/list).

You can revoke your consent to the use of Google Ads at any time: by rejecting the corresponding marketing and tracking cookies in the consent management tool (see section 8.1.2), by deactivating personalized advertising at adssettings.google.com, or by generally blocking cookies in your browser.

Further information on data processing by Google can be found in the Google Privacy Policy (https://policies.google.com/privacy) and for Google Ads at policies.google.com/technologies/ads. At adssettings.google.com/authenticated, you can customize how Google displays advertisements.

Meta Pixel
We use Meta Pixel, an analytics tool from Meta Platforms Ireland Limited ("Meta"), on our website. Meta Pixel enables us to track website visitors' behavior and deliver personalized advertising on Meta services (primarily Facebook and Instagram) to evaluate their effectiveness. Processing requires your consent, which we obtain via the consent management tool (see section 8.1.2).

The Meta Pixel may transmit the following data to Meta, among other things: websites visited, actions performed, IP address, browser and device data, referrer URL, pixel ID. This data may enable Meta to associate visitors to our website with specific Facebook and Instagram users.

Data may be transferred to Meta Platforms, Inc. in the USA. This is done in accordance with the Data Privacy Framework under which Meta is certified (see www.dataprivacyframework.gov/list).

You can revoke your consent to the use of the Meta pixel at any time: via the consent management tool, Meta's advertising settings at www.facebook.com/adpreferences, or by blocking cookies in your browser.

For more information on Meta's data processing, please refer to the Meta Privacy Policy (https://www.facebook.com/privacy/policy) and the Meta Pixel explanation in the Facebook Help Center (https://www.facebook.com/business/help/742478679120153).

YouTube  
We use videos from the YouTube platform, a service provided by Google Ireland Limited (https://www.google.de/contact/impressum.html), on our websites. When you visit our pages with embedded YouTube videos, YouTube may process data. YouTube videos are embedded based on your consent, which we obtain via the consent management tool (see section 8.1.2).

When you view embedded YouTube videos, data is transmitted to YouTube/Google, such as your IP address, device and browser information, interactions, your logged-in Google account (if you are also logged in to YouTube/Google), cookies, and similar tracking technologies.

You can revoke your consent at any time: via the consent management tool, by blocking YouTube domain cookies in your browser, and by logging out of your Google account.
YouTube/Google may transfer data to the Google LLC server in the USA. This is done in accordance with the Data Privacy Framework under which Google is certified (see www.dataprivacyframework.gov/list).

Further information on data processing by YouTube/Google can be found in the Google Privacy Policy (https://policies.google.com/privacy) and in the help section (e.g., support.google.com/youtube/answer/171780).

Vimeo
We embed videos from the provider Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, USA. The use is based on your consent, which we obtain via the consent management tool (see section 8.1.2).

When you visit a page with Vimeo videos, the following data may be transferred: IP address, device and browser information, interactions with the video, cookies, tracking technologies, data linking to your Vimeo account (if logged in). Vimeo may also use Google Analytics.

You can revoke your consent via our consent management tool, block Vimeo cookies in your browser, and, if necessary, log out of your Vimeo account.

Data may be transferred to Vimeo in the USA. For more information, please visit vimeo.com/privacy.

Google Maps
On our website, we use the Google Maps map service from Google Ireland Limited (https://www.google.de/contact/impressum.html). By integrating Google Maps, we can display interactive maps directly on our website and enable convenient use of the map functions. Use is based on your consent, which we obtain via the consent management tool (see section 8.1.2).

When using Google Maps, the following data is transmitted, depending on the integration: IP address, browser and device data, location data (if shared via the browser or device), referrer URL (which page you came from), technical connection data, interactions with the map, and Google cookie data (e.g., preferences, usage statistics). If you are logged into a Google account, Google can assign the data to your personal account.

You can revoke your consent at any time: via the consent management tool, by blocking Google Maps cookies in your browser, by deactivating JavaScript (note: loss of functionality), or, if necessary, by logging out of your Google account.

Data may be processed on Google LLC servers in the USA. Google is certified under the EU-US Data Privacy Framework (see www.dataprivacyframework.gov/list). 
Further information on data processing by Google can be found in the Google Privacy Policy (https://policies.google.com/privacy) and in the Terms of Use for Google Maps (https://www.google.com/intl/de_de/help/terms_maps/).

8.1.5 Online shops and customer portal

You can register in our online shops and in our equipment management customer portal to purchase our products and manage your equipment. Personal data is collected and processed in the process.

CAT Parts Store
You can purchase genuine CAT replacement parts online from the CAT Parts Store. The store is operated by Caterpillar Inc. and has interfaces to the Avesco IT systems for order processing. You will be registered on Caterpillar's e-commerce environment and will receive a Caterpillar ID. Caterpillar is responsible for the processing of personal data. Please refer to the privacy policy for Parts.Cat.Com (https://parts.cat.com/de/catcorp/legal/privacy).

8.1.6 Contacting us and requesting quotes

You can use contact forms on our website to request a quote or contact a sales or service advisor, for example. If you do so, the data you enter in the input mask will be transmitted to us and stored. When you send the message, the following data is also stored: IP address, date and time, browser and version, and the referring URL.
Your consent will be obtained for the processing of your data as part of the sending process, and this privacy policy will be referenced. If you contact us in any other way (e.g., by email, telephone, or social media), the data you transmit will be processed.

The basis for processing the personal data transmitted in this way is your consent (confirmation in the contact form) to process the message you have sent. We also use the data to prevent misuse of the contact form and to ensure the security of our information technology systems.

You have the right to revoke your consent at any time. In this case, we will delete the personal data stored in the context of the contact. The request cannot then be processed. Furthermore, the data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. This is the case when the matter has been clarified, and communication with the user has thus been terminated.

8.2 Social media

We maintain online presences on social networks and platforms in order to communicate with active customers, interested parties, and users, and to inform them about our services. When you access the respective networks and platforms, personal data is collected and processed by the respective social network providers. When you click a link on our website to a social media profile, a direct connection is established between your browser and the server of the respective social network. This provides the network with information that you visited our website using your IP address and clicked the link. If you are logged in to the relevant network or log in there after clicking on the link, your visit to our website will be directly assigned to your account.

The terms and conditions and privacy policy of the respective operator apply to the associated data processing. For message exchange, see section 8.1.6.

8.3 Transfer of data to Caterpillar Inc.

Avesco transmits customer master data (company name, company address, name, email address, telephone number, contact person's position) and information on purchased products or services used to Caterpillar Inc. (CAT) in the USA. There, the data is processed to support any necessary recalls and to improve CAT's products and services. This ensures that you receive the best possible repair and maintenance service, guaranteeing optimal maintenance of your construction machine, and that you are immediately informed about current developments and product safety measures from CAT.

Data processing for the transmission of master and service data is carried out to protect the legitimate interests of Avesco and CAT, for example, for billing and product registration purposes, and to optimize products and services. To ensure an adequate level of data protection in the USA, Avesco has agreed to the EU standard contractual clauses with CAT. Avesco will provide the contracts on request.

CAT explains its handling of personal data in its "Caterpillar Global Data Privacy Statement," available at www.caterpillar.com/dataprivacy.

8.4 Job applications

We receive personal data as part of an application. This includes names, addresses, dates of birth, cover letters, resumes, references, information provided by the applicant, results of aptitude tests, and interview information. We process this data exclusively for the purpose and within the scope of the application process. If you apply via our job portal, you agree to the privacy policy posted there. If you apply via a recruitment agency, we assume that you have given your consent for your dossier to be passed on. Avesco also searches for suitable candidates for vacant positions on professional platforms and uses the personal data published there to check whether a person is suitable for Avesco and, if necessary, to contact them. This data will be deleted after the selection process has been completed, provided that no application process follows. The basis for the search is Avesco's legitimate interest in filling positions with suitable individuals. You have the right to object.

If no contract is concluded, your data will be deleted unless you have given us your consent to further storage, e.g., for inclusion in a talent pool.

8.5 Newsletter

We send newsletters, emails, and other electronic notifications containing promotional information (hereinafter referred to as "newsletters"). We use the user's email address and collect technical information when the newsletter is accessed, such as the browser and system used, the IP address (and thus the location from which the newsletter is accessed), and the time of access. For this purpose, our newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened.
We use the data to deliver the newsletter, improve the technical aspects of our services, and conduct evaluations to identify our users' reading habits and tailor our content to them. We do not monitor individual users' behavior.

The newsletter is sent either with the recipients' consent or on the basis of our legitimate interests in direct marketing. If the newsletter's content is specifically described when registering for it, this content is decisive for users' consent. In addition, our newsletters contain information about our services and about us.

You can unsubscribe from our newsletter at any time and revoke your consent. You will find a link to unsubscribe from the newsletter at the end of each newsletter or by visiting www.avesco.ch/newsletter. We may store unsubscribed email addresses for up to 3 years based on our legitimate interests before deleting them, to be able to prove that consent was given. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed.

9. Video surveillance

Avesco uses video surveillance on its premises to ensure the safety of visitors, protect property, and prevent and investigate unlawful activities. Personal data is processed in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR), based on Avesco’s legitimate interest in maintaining a safe and secure environment.
Cameras are installed throughout Avesco’s premises, including yard and parking areas, warehouse and service facilities, and shared areas within office buildings. Video surveillance is not conducted in restrooms, changing facilities, or other areas where individuals would reasonably expect privacy.

The system records video footage within the cameras’ field of view, which may include images and movements of individuals. Audio is not recorded, and the system does not use automated facial recognition. Recordings are generally retained for up to 30 days, unless specific footage needs to be preserved for the investigation of an incident or to comply with legal obligations.

Individuals have the right to request access to personal data relating to them and to lodge a complaint with the competent data protection authority. Requests may be submitted by email to info.ee@avesco-cat.com.

10. Changes to this privacy policy

Avesco keeps this privacy policy up to date at all times. It may be necessary to adapt the privacy policy to changed actual or legal conditions. The currently valid version is always the one published on the Avesco website.

11. Contact for data protection matters

If you have any questions about the collection, processing, or use of your personal data, or if you wish to request information, correction, blocking, or deletion of data, or to assert other rights to which you are entitled, please contact dataprotection@avesco.ch.