Data Protection Policy for Social Networks

1. General Information about the collection of personal data

a) We attach importance to protecting your privacy when you use our profile pages in social networks. In this respect, we use your personal data in accordance with the legal data protection regulations. Personal data are all data that can be related to you personally, e.g. name, address, e-mail address and user behaviour. The following contains information about how we deal with your personal data.

b) The controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) is ITW Fastener Products GmbH, Am Pulverhäuschen 7, D-67677 Enkenbach-Alsenborn. You can contact our data protection officer at datenschutz@itw-efc.com or via our postal address to the attention of the “Data Protection Officer”.

c) If you are under the age of 16, please obtain permission from a parent/guardian before making available any personal information to ITW Fastener Products GmbH.

We maintain publicly accessible profiles on various social networks. When you visit these profiles, you initiate a variety of data processing operations. The following contains an overview of your personal data that are collected, used and stored by us when you visit our profiles. Personal data are information that can be assigned to you as a specific person (e.g. name, age, address, photos, e-mail addresses and potential IP addresses).

We would like to point out that you use all social networks and their functions at your own responsibility. This applies, in particular, to the use of interactive functions (e.g. sharing, liking, disliking and commenting).

Insofar as you use our profiles in social networks, we process the following data, depending on the purpose for which you make your personal data available to us:

Surname, first name, place of residence, telephone number, e-mail address, username, job title and employer.

The precise purposes for which we may process your personal data in the respective social network, as well as the legal basis on which we process your data, can be found in the description of the respective social network under point 2. a) to e) in this Data Protection Policy.

Furthermore, we are informing you about the rights you have with regard to the processing of your personal data in dealings with us. You do not undertake to make your personal data available to us. However, this may be necessary for individual functionalities of our profiles on social networks. These functionalities will not be available to you or will only be available to you to a limited extent if you do not make your personal data available to us.

When you visit our profiles, your personal data are not only collected, used and stored by us, but also by the operators of the respective social network. This also occurs if you yourself do not have a profile in the respective social network. The individual data processing operations and their scope differ depending on the respective social network operator, and they are not necessarily traceable for us. Please refer to the data protection declarations of the respective operator for details about the collection and storage of your personal data as well as the type, scope and purpose of their use by the respective social network operator:

• The privacy policy for the social network Facebook, which is operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, can be viewed at https://www.facebook.com/about/privacy/update?ref=old_policy;

• The privacy policy for the social network Instagram, operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA, can be viewed at https://help.instagram.com/155833707900388;

• The privacy policy for the social network YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be viewed at https://www.gstatic.com/policies/privacy/pdf/20190122/f3294e95/google_privacy_policy_de_eu.pdf;

• The privacy policy for the social network LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, can be viewed at https://de.linkedin.com/legal/privacy-policy;

• The privacy statement for the social network XING, operated by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany, can be found at https://privacy.xing.com/de/datenschutzerklaerung.

a) Facebook:

We operate a company profile (“fan page”) with the name “ITW Global Fasteners (@itwglobalfasteners)” on the social media network Facebook, in particular for self-promotion, but also for the purpose of promotional customer communication and recruiting.

According to the ruling of the European Court of Justice (ECJ), dated 05.06.2018, reference no. C-210/16, the operator of social media sites is at least jointly responsible for data processing, at least in the case of Facebook fan pages. Article 26, GDPR, is authoritative. Facebook provides such a statement at https://www.facebook.com/legal/terms/page_controller_addendum. However, we do not know whether or not this now meets the requirements of GDPR.

We only process your data – apart from any further procedures listed below – if you contact us via the platform, register for a premium content from us, such as a whitepaper, a webinar, an e-book, etc. or apply for an advertised position via Facebook for precisely these purposes. In this case, Facebook collects your data and makes that data available to us. If you register for premium content, we will send you an e-mail, which you must confirm. In this case, Facebook collects your data and makes that data available to us.

Under certain circumstances, we may also store and further process such data. Processing your personal data in the event of an enquiry or application is based on our other data protection statements in this respect.

Depending on the case constellation, the legal basis for the processing of personal data is the processing for initiating and executing contracts entered into with you in accordance with Article 6(1), Point b, GDPR, or on the basis of our legitimate interest in communicating with users and our external presentation for the purpose of advertising in accordance with Article 6(1), Point f, GDPR. Insofar as you have granted consent to the social network provider for the aforementioned data processing with effect for us, the legal basis is Article 6(1), Point a, GDPR.

b) Instagram:

We maintain a company profile with the name “ITW Global Fasteners (@itwglobalfasteners)” on the social network Instagram to communicate with users registered there and to provide information about our company and products and services. In addition to recruit members.

According to the ruling of the European Court of Justice (ECJ), dated 05.06.2018, reference no. C-210/16, the operator of social media sites is at least jointly responsible for data processing, at least in the case of Facebook fan pages. Article 26, GDPR, is authoritative. We are not aware that Instagram offers an agreement that meets the requirements of Article 26, GDPR. We assume that this decision applies by way of analogy to other social networks, including Instagram.

We process your data that you forward to us via this network to communicate with you and reply to your messages there.

We also process your data if you register for premium content from us, such as a whitepaper, a webinar or an e-book etc., or apply for an advertised job via Instagram for these very purposes. In this case, Instagram collects your data and makes that data available to us. If you register for premium content, we will send you an e-mail, which you must confirm.

Under certain circumstances, we may also store and further process such data. Processing of your personal data in the event of an application is based on our Applicant Data Protection Policy.

The legal basis for the processing of personal data is our legitimate interest in communicating with users and our external presentation for the purpose of advertising in accordance with Article 6(1), Point f, GDPR, as well as the processing of your personal data to initiate and execute contracts entered into with you in accordance with Article 6 (1), Point b, GDPR. Insofar as you have granted consent to the social network provider for the aforementioned data processing with effect for us, the legal basis is Article 6(1), Point a, GDPR.

c) LinkedIn:

ITW Fasteners Products GmbH operates a company profile under the name “ITW Global Fasteners” on the LinkedIn platform. According to the ruling of the European Court of Justice (ECJ), dated 05.06.2018, reference no. C-210/16, the operator of social media sites is at least jointly responsible for data processing, at least in the case of Facebook fan pages. Article 26, GDPR, is authoritative. We assume that this decision applies by way of analogy to other social networks, including LinkedIn. LinkedIn provides such a statement at https://legal.linkedin.com/pages-joint-controller-addendum. However, we do not know whether or not this now meets the requirements of GDPR

We only process your data if you contact us via the LinkedIn platform, register for a premium content from us, such as a whitepaper, a webinar or an e-book etc. or apply for an advertised position via LinkedIn for these very purposes. In this case, LinkedIn collects your data and makes that data available to us. If you register for premium content, we will send you an e-mail, which you must confirm.

Depending on the case constellation, the legal basis for the processing of personal data is the processing for initiating and executing contracts entered into with you in accordance with Article 6(1), Point b, GDPR, or on the basis of our legitimate interest in communicating with users and our external presentation for the purpose of advertising in accordance with Article 6(1), Point f, GDPR.

Insofar as you have granted consent to the social network provider for the aforementioned data processing with effect for us, the legal basis is Article 6(1), Point a, GDPR. Under certain circumstances, we may also store and further process such data. Processing of your personal data in the event of an application is based on our Applicant Data Protection Policy.

d) YouTube:

We operate a company channel with the name tbd on the social media network YouTube of Google Inc., in particular for self-presentation, but also for promotional communication with potential customers, employees or other persons.

According to the ruling of the European Court of Justice (ECJ), dated 05.06.2018, reference no. C-210/16, the operator of social media sites is at least jointly responsible for data processing, at least in the case of Facebook fan pages. Article 26, GDPR, is authoritative. We assume that this decision applies by way of analogy to other social networks, including YouTube. Based on current knowledge, we are not aware that YouTube provides such an agreement.

We only process your data if you contact us via the YouTube platform.

In this case, YouTube collects your data and makes that data available to us. Under certain circumstances, we may also store and further process such data. Processing of your personal data is then based on one of our other data protection statements, depending on which group of data subjects you belong to.

Depending on the case constellation, the legal basis for the processing of personal data is the processing for initiating and executing contracts entered into with you in accordance with Article 6(1), Point b, GDPR (e.g. in the case of questions about products or services) , or on the basis of our legitimate interest in communicating with users and our external presentation for the purpose of advertising in accordance with Article 6(1 p. 1), Point f, GDPR. Insofar as you have granted consent to the social network provider for the aforementioned data processing with effect for us, the legal basis is Article 6(1), Point a, GDPR.

e) XING:

We operate a company profile “ITW Fastener Products GmbH” on the professional social media network XING, in particular for self-promotion, but also for recruiting. To that end, XING is also linked to the employer rating platform kununu.

According to the ruling of the European Court of Justice (ECJ), dated 05.06.2018, reference no. C-210/16, the operator of social media sites is at least jointly responsible for data processing, at least in the case of Facebook fan pages. Article 26, GDPR, is authoritative. We assume that this decision applies by way of analogy to other social networks, including XING. Based on current knowledge, we are not aware that XING provides such an agreement.

We only process your data if you contact us via the XING platform or apply for an advertised position via XING.

We also process your data if you register for premium content from us, such as a whitepaper, a webinar or an e-book etc., or apply for an advertised job via XING for these very purposes. In this case, XING collects your data and makes that data available to us. If you register for premium content, we will send you an e-mail, which you must confirm.

In this case, XING collects your data and makes that data available to us. Under certain circumstances, we may also store and further process such data. Processing of your personal data in the event of an application is based on our Applicant Data Protection Policy.

Depending on the case constellation, the legal basis for the processing of personal data is the processing for initiating and executing contracts entered into with you in accordance with Article 6(1), Point b, GDPR, or on the basis of our legitimate interest in communicating with users and our external presentation for the purpose of advertising in accordance with Article 6(1), Point f, GDPR.

Insofar as you have granted consent to the social network provider for the aforementioned data processing with effect for us, the legal basis is Article 6(1), Point a, GDPR. Under certain circumstances, we may also store and further process such data. Processing of your personal data in the event of an application is based on our Applicant Data Protection Policy.

3. Information about the collection of personal data

In some cases, users’ data on social networks are used to conduct market research and, therefore, pursue advertising purposes. We also receive anonymous statistics about the application and usage of our profiles for all social networks. The following information inter alia is made available:

• Followers: number of people who follow ITW Fastener Products GmbH. This includes growth and development during a defined time frame.

• Reach: number of people who see a specific post. Number of interactions on a post. This can be used, for example, to determine which content is better received by the community than others.

• Post performance: how many people were reached with a post or paid ad and interacted with it and how?

• Statistics about interests and demographics

We cannot draw any conclusions from these statistics about individual users. We use these statistics to constantly improve our online offer on the respective social network and better respond to our users’ interests. We cannot link the statistical data with the profile data of our fans. By way of your settings on the respective social network, you can decide on the form of targeted advertising that is displayed to you.

4. Profiling

No automated decision-making shall apply based solely on automated processing, including profiling, which produces legal effects or similarly affects you.

5. Your rights

In accordance with the GDPR provisions, you may assert the following rights against us:

• Right to receive information

• Right to correction

• Right to restriction of processing

• Right to erasure / right to be forgotten

• Right to data portability

• Right to object

Insofar as the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, with effect for the future. This does not affect the lawfulness of the processing performed on the basis of the consent up to the withdrawal.

To exercise any of your rights listed above, or if you believe that we are processing your personal data in an unlawful manner, please contact us at:

datenschutz@itw-efc.com

You also have the right to contact the data protection supervisory authority. The competent supervisory authority is:

State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate, Hintere Bleiche 34, D-55116 Mainz.

We delete stored data as soon as their storage is no longer necessary or you ask us to delete such data. In the case of statutory storage obligations, we limit the processing of the stored data accordingly.

7. Data processing location