Customer Privacy Notice

1. Who is responsible for the processing of your personal data

This Customer Privacy Notice ("Notice") applies to the ABB Group of companies, which means ABB Ltd, Switzerland and each entity in which ABB Ltd, Switzerland, directly or indirectly, has a majority holding or owns or controls the majority of voting rights. The ABB company that is providing services or communicating to you (referred to as "ABB" or "we"), is responsible for the processing of your personal data and controls how it is used, in accordance with this Notice.

Other subsidiary companies of ABB may also receive and process your personal data, either in the capacity of controller or processor and this Notice applies equally to them.

2. The types of information we collect and use

We collect and use personal data that concerns you in connection with the agreements with our customers We may collect the following categories of personal data:

• The business contact information you share with us:name, title, job title, email address, business address, telephone number, mobile telephone number
• Additional information you provide to us in the course of our business relations, such as:interests in ABB products, marketing preferences, registration information provided at events, webinars, fairs, contract or order data, invoices, payments, business partner history, data concerning the fulfilment of our contractual obligations and pre-contractual measures including marketing activities, correspondence data, offers, tenders, contract and order data, invoices, payments, insurance data, records relating to queries/questions/complaints/orders, employee number, passport number, date of birth, travel visa information, interview assessment/feedback, training records, gender, customer/consumer ID, product usage data, preferences.
• Electronic identification data and information collected by the communications systems, IT applications and website browser, such as: IP address, the source of your site visit, webpage views and time spent on the website or a particular page, links clicked, comments shared, emails opened, browser type, date and time of visit, device identifiers (mobile device ID, PC ID etc.), cookies, digital alias/signature, registration and login credentials, tracking/analytics data.

The below mentioned types of personal data are only collected and processed, if at all, in accordance with applicable local laws in your country of residence.

• Data about criminal convictions and offences, such as: criminal background information and sanction list information to the extent required for the purposes of criminal background screening and Know Your Customer (“KYC”) and Anti Money Laundering (“AML”) obligations.
• To the extent necessary to fulfil our obligations, data obtained from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. a credit agency):commercial register data, association register data, creditworthiness data.

3. Why we use your personal data

We may use your personal data as described above for the following purposes:

• processing and fulfilling orders, delivering services and keeping you informed about the status of your or your company’s order;
• providing and administering our products and services;
• processing quotation offer and managing the customer relationship including providing customer and product support and process, evaluate and respond to requests and inquiries, contract lifecycle management, and capturing personal data of potential customers for future communications;
• conducting and facilitating customer satisfaction surveys, marketing campaigns, market analysis, sweepstakes, contests, or other promotional activities or events;
• conducting marketing and sales activities (including generating leads, pursuing marketing prospects, performing market research, determining and managing the effectiveness of our advertising and marketing campaigns and managing our brand and communicating about new business projects);
• sending you marketing communications by post, telephone, text, email and other digital methods about products and services (such as alerts, promotional materials, newsletters, etc.);
• analyzing personal data to provide with relevant marketing offers and information, ensure accuracy of customer contact information.
• conducting customer trainings and courses
• reporting and data analytics such as market research, trend analysis, financial analysis, customer segmentation and profiling of customers in order to improve the customer experience with ABB and provide better and more personalized content including market intelligence and development and improvement of services or products through assessment and analysis of the information;
• communicating with Business Partners about products, services and projects of ABB or Business Partners, e.g. by responding to inquiries or requests;
• travel arrangement, ticket and workflow management, fleet management;
• reorganization, acquisition and sale of activities, business units and companies;
• management of process quality and insurance management;
• carrying out audits, reviews and regulatory checks to meet obligations to regulators;
• governance, risk and compliance, including due diligence and Anti Money Laundering (“AML”) obligations, customs and global trade compliance and sanctioned party list screening, security, including prevention, detection of crime and fraud;
• maintaining and protecting the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, and fraud or other criminal or malicious activities; and
• managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), user accounts creation and management, software licenses assignment and management, security and performance testing and business continuity, monitoring access to systems, downloads.

To confirm the accuracy of your contact information, provide you with tailored marketing communication and advertisement and send you personalized messages, we will use automated methods to build a profile based on data that we have obtained as described in this notice such as the number of ABB webpage views, opened emails, your webinar registrations and the recent interaction and activities with ABB. In case you would like to be provided with more information about the automated methods to build a profile, you can request that by submitting a request at www.abb.com/privacy. You have the right to object to profiling activities by submitting a data subject request at www.abb.com/privacy.

We collect only the personal data from you that we need for the purposes described above. For statistical purposes, improvement of our services and testing of our IT systems we use as much as reasonably possible anonymized data. This means that these data can no longer (in)directly identify you or single you out as an individual.

4. What happens if you do not provide us with the information we had asked you for or if you ask us to stop processing your information

Where it concerns processing operations related to the business relationship with you, ABB will not be able to adequately establish, conduct or terminate a business relationship with you or your company and generally perform the purposes described above without certain personal data. Although we cannot obligate you to share your personal data with us, please note that this then may have consequences which could affect the business relationship in a negative manner, such as not being able to take requested pre-contractual measures to enter into a contract with you or your company or to establish and continue the business relationship you have asked for.

5. The legal basis we rely on

We use your personal data for the purposes described in this notice based on one of the following legal bases, as applicable:

• We may process your personal data for the fulfilment of contractual obligations resulting from contracts with you or your company, or as part of pre-contractual measures we have been asked to take;
• We will ask your consent for the activities described in this privacy notice when required by applicable law, for example when we process your data for marketing purposes including sharing tailored marketing communication with you, sending you personalized messages, and to ensure accuracy of your contact information where we don’t have an existing business relationship with you or your company; or
• We will rely on our legitimate interests to process your personal data within the scope of the business relationship with you or your company insofar as this is not overridden by your own privacy interests. Such interests may include:
• collection and use the personal data for this purpose are management and furtherance of our business.
• conduct, management, development and furtherance of our business in the broadest sense possible including supply of products and services, performance of agreements and order management with customers, process and fulfilment of purchases, process quality management and improvement of products or services, analytics and market intelligence, reduction of default risks in our sales processes, enforcement of legal claims, including debt collection via out-of-court procedures, and reorganization, acquisition and sale of activities, business divisions and companies;
• for direct marketing purposes for existing customers including sharing tailored marketing communication with you, sending you personalized messages, and to ensure accuracy of your contact information;
• monitor, investigate and ensure compliance with legal, regulatory, standard and ABB internal requirements and policies;
• prevent fraud and criminal activity including investigations of such activity, misuse of ABB assets, products and services, and as strictly necessary and proportionate for ensuring network and information security; and
• transmitting personal data within the ABB group for internal administrative purposes as necessary for example to provide centralized services.

You may obtain a copy of our assessment of why we may process your personal data for these interests by submitting a request at www.abb.com/privacy.

• In some cases, we process your personal data on the basis of legal obligations and statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities, statutory retention periods or the disclosure of personal data within the scope of official or judicial measures may be required for the purposes of taking evidence, prosecution or enforcement of civil law claims.

With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.

6. Parties we share your personal data with (in and outside the EU and EEA or outside the country where the ABB company that controls your data is located)

We only share your personal data with other ABB affiliates or third parties as necessary for the purposes described in this table below. Where we share your personal data with an affiliate or third party so that it is transferred to or becomes accessible from outside the European Union (“EU”) and the European Economic Area ("EEA") or outside the country where the ABB company that controls your data is located, we always put adequate safeguards in place to protect your personal data. Examples of these safeguards are an adequacy decision of the European Commission or Standard Contractual Clauses. We have taken additional measures for the transfer of data from within to outside the EU, EEA and outside the country where the ABB company that controls your data is located to protect your personal data. If you would like an overview of the safeguards which are in place, please submit a request at www.abb.com/privacy.

7. How long we keep your personal data

Based on mandatory legislation, ABB must keep certain personal data for a minimum period of time. We only keep your personal data for as long as necessary for the purposes described in this privacy notice, or until you notify us that you no longer wish to receive ABB marketing materials.

In general, customer related personal data is kept for the duration of the contractual relationship and for a minimum period (typically between 5-10 years after the termination of the contract) or for longer period if required by local laws and regulatory requirements. The profile built based on automated methods as described in this notice is kept up to 24 months.

At the same time, applicable data protection laws require that we do not keep personal data in an identifiable form for any longer than is necessary for the purpose for which the personal data is being processed. Through the setting of IT applications and policies we ensure that our keeping of your personal data is deleted when we no longer need it.

8. Your data privacy rights

Depending on the jurisdiction in which you are located and in which your personal data is processed, you may have the following rights:

Please note that the rights described above are not absolute, and that your request cannot always be met entirely. For example, sometimes we cannot delete or restrict the processing of your personal data as we may have legal obligations or contractual obligations to keep certain personal data.

You may request to enforce your data privacy rights at www.abb.com/privacy.

9. Contact and further information

If you want to access your personal data, make use of any of your other rights mentioned above or if you have any questions or concerns about how ABB processes your personal data, please contact our Group Data Protection Officer at privacy@abb.com, or submit your complaint at www.abb.com/privacy.

Should you not be satisfied with our response or believe we are processing your personal data against the law, you may also have the right to file a complaint with the Data Privacy Authority in your country of residence or work, or seek a remedy through the courts where you believe an infringement of data privacy laws may have taken place.

10. Updates to this document

This Privacy Notice may be updated from time to time as a result of required developments. In case of such updates, we will undertake necessary actions to inform you about them depending on the importance of changes done. If and where required by applicable laws we will also ask for your consent to any material Privacy Notice changes describing our up-to-date practices.

Please check the “date of publication” to see when this Privacy Notice was updated.

Additional information on personal data protection for residents in Korea

1. Rights of legal representative and method of exercising the rights

A legal representative may request any time to view, correct/delete, suspend the processing of, and withdraw consent to personal data. In this case, a legal representative has to contact us by using the contact information above with user’s POA attached.

2. Period of retention and use of personal data; destruction of personal data

In principle, we immediately destroy relevant personal data after the purpose of collection and use is achieved. However, if applicable laws and regulations require us to retain the data, we will store it for a certain period prescribed in the applicable laws and regulations. In this case, we will transfer the relevant data to a separate data base or other storage place.

• Records on contract or subscription withdrawal: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
• Records on price settlement and goods supply: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
• Records on consumer complaint or dispute settlement: 3 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
• Records on collection/processing and use of credit information: 3 years (Use and Protection of Credit Information Act)
• Records on labelling/advertising: 6 months (Act on the Consumer Protection in Electronic Commerce, Etc.)
• User’s internet log records/user’s access point tracking data: 3 months (Protection of Communications Secrets Act)
• Other data verifying communication facts: 12 months (Protection of Communications Secrets Act)

Personal data destruction process and destruction method

In principle, we immediately destroy personal data after the purpose of collection and use of the personal data is achieved. The process and method of destruction are as follows:

(1) Destruction process

Once the purpose is achieved, user’s personal data is moved to a separate DB (or a document box in the case of papers) and is destroyed after storage for a certain period depending on data protection reasons under our internal policy and other applicable laws and regulations (Refer to the period of retention and use of personal data). The personal data moved to a separate DB will not be used for other purpose other than the purpose of retention, unless otherwise provided by laws.

(2) Destruction method

We delete personal data stored in the form of electronic file by using the technical means that make it impossible to restore the data. For personal data printed in papers, we shred it via paper shredder or incinerate it.

3. Children

In principle, we do not collect personal data of Korean residents under 14. Therefore, residents in Korea under 14 must not provide their personal data to use our service.

4. Installation and operation of automatic collection device for personal data; rejection thereof

We operate ‘cookies’ that may store and find a user’s information from time to time. A cookie is a very small text file that a server, used by us to operate our website, sends to a user’s browser and is stored in the hard disc of a user’s computer.

(1) Purpose of using cookie, etc.:

Implementation of automatic login function; analysis of a member/nonmember’s visit frequency or time; understanding of the preference and concerns of a user and tracing of the footsteps of the user; providing target marketing and customized services by identifying the degree of participation in various events and the number of visits.

(2) How to reject installation of cookies

A user has the right to choose the installation of cookies. In other words, a user may either allow all cookies by setting an option on his/her web browser, or make confirmation every time a cookie is stored, or reject storage of all cookies.

Provided, however, that if a user rejects the installation of cookies, there may be a difficulty for us to provide service.

• How to set cookies (If you use Internet Explorer 8.0)
• Go to “Tool” menu and click “Internet Options.” Click “Privacy” tab. Click “Settings” and set your level of accepting cookies.
• How to see the cookies you have received (If you use Internet Explorer 8.0)

Go to “Tool” menu and click “Internet Options.” Click “General” tab, and click “Settings” in Search Record section. Click “View Files.”

• How to reject the installation of cookies (If you use Internet Explorer 8.0)

Go to “Tool” menu and click “Internet Options.” Click “Privacy” tab.

Click “Settings” and adjust to high level in order to “Block all cookies.”

Date of publication: 01.03.2021