Privacy statement

KONE Corporation and its employees, partners, subsidiaries and affiliates (“KONE” or ”we”) are committed to protecting your privacy and personal data. KONE processes your personal data in accordance with international and European data protection principles and applicable personal data legislation (including the European General Data Protection Regulation, as applicable).

The purpose of this privacy statement ("Privacy Statement”) is to provide you comprehensive information about processing of your personal data as a representative, contact person or other stakeholder of our customer, supplier or subcontractor, or as an end-user of our webpage or other internet services, including the following information:

what personal data we process on you
for what purposes and on what legal grounds we process your personal data
from where we collect your personal data
how long we store your personal data
to whom we may share your personal data
where we may transfer your personal data and under what safeguards
what rights and options you have regarding the processing of your personal data

This privacy statement is divided into sections that provide specific information to you as an individual depending on your relationship with KONE as well as general information applicable to all groups of individuals:

Purpose of this Privacy Statement
Data Controller and Contact Information
End-user Data of Webpages and Internet Services
Customer Data
Supplier and Subcontractor data
Recipients of your Personal data and International Transfers
Your Rights
Updates to this Privacy Statement

This Privacy Statement may be supplemented by solution or service specific privacy statements and additional local documentation. Moreover, the different rights you have as a data subject may also vary from country to country depending on the applicable privacy laws. In this Privacy Statement we present the rights granted by the European Union data protection laws.

The local KONE group company with whom you are or have been in contact with or otherwise have the closest relationship with, is the data controller of your personal data.

Many of the tools and processes used in KONE are global and made available to local KONE entities in a centralized manner by KONE Corporation. In these global tools and processes, personal data is controlled jointly by the local KONE group company and KONE Corporation.

In all data protection related matters, you may contact KONE by using the following contact information:

KONE Corporation

Address: KONE Building, Keilasatama 3, P.O. Box 7, 02150 Espoo, Finland
Telephone: +358 204 751
Contact person: Global Legal, Data Protection Counsel, personaldatarequest@kone.com
All requests that relate to using of data subject’s rights can be send to KONE by using the contact form available on the kone.com webpage at https://www.kone.com/en/contact.aspx (select option “Personal Data Enquiry”).

This section provides you with general information on the processing of your personal data by KONE related to this website and the other internet services of KONE you use or visit (the “Site”).

Please read this Privacy Statement carefully if you plan to browse or otherwise use the Site. If you do not agree with this Privacy Statement, you must leave the Site. Provision of personal data is voluntary on the Site but if you choose not to disclose your personal data, we will not necessarily be able to provide you with our services.

You may not provide or permit us to collect any personal data relating to another person, unless you have the authority to share that data and to permit us to use the data as described in this Privacy Statement.

3.1 Collected Personal Data

Generally, you can visit the Site without entering any personal data. The Site is technically divided into separate sections some of which may require us to collect more personal data of you while some may be used without processing any personal data.

When visiting the Site, certain technical and other information is automatically sent by your computer to us (i.e. IP address, the type of your browser and the source of your visit). We also collect information about your website usage by using cookies. Please see Section 3.4 below regarding cookies for further information.

On certain parts of the Site, you may be asked to provide personal data and/or sign up for the service to access a service that you have requested. Once you register on the Site or have otherwise been assigned a specific identification code to access your accounts, we may request that you provide certain information.

3.2 The Purposes and Legal Grounds of the Processing

The purpose of KONE’s processing of personal data collected through the Site is to:

ensure an efficient and secure use of the Site;
develop the Site for a better quality and broader scope of services;
provide customized services and content (including marketing) recognizing your specific needs and interests;
improve our services to you;
contact you;
conduct research and collect statistics (e.g. what sections of our Site the users visit and how much time they spend on the Site).

The legal grounds for data processing are KONE’s legitimate interests relating to the abovementioned purposes. When required by applicable laws, KONE will request your consent for personal data processing.

3.3 Source(s) of Personal Data and Retention Period

The personal data is received directly from you or obtained in connection with your use of the Site.

The personal data will be stored as long as needed for the purposes it has been collected for or for longer period if other justified reason exists (for example, legal obligation). After that, the personal data will be effectively deleted or made anonymous.

Please see Section 3.4 below for information on storing cookies.

3.4 Cookies

From time to time KONE may place information, commonly known as “cookies”, on your computer or mobile device. When we refer to ”cookies” in this Privacy Statement, we refer to also other similar technologies that collect and store information in your browser.

Cookies are used for improving the functioning of the Site, to track and analyze the use of the Site, support your use of the Site, enabling targeted advertising and similar purposes. We have categorized the purpose of the cookies we use on our Sites to the following categories:

Necessary cookies that are necessary for the website to function as intended.
Analytics cookies that allow us to count visits and traffic source to measure and improve performance of our sites.
Targeting cookies that are set by our marketing partners to show you relevant adverts.

Cookies that are ”necessary” are always active and we do not request your consent on placing such cookies. In other cases, we request your consent to place the cookie when you visit our Site.

We use cookies that are stored for certain limited time period (typically no longer than 364 days) and session cookies, which are stored only for the duration of your browsing session.

You may find more information on necessary, analytics and targeting cookies, as well as the detailed list of the cookies, including their specific purposes, durations and types in the cookie banner on our Site.

You may always disable cookies or manage your cookies preferences on your web browser settings or on our Site from ”manage cookie preferences” functionality. Kindly note, that disabling cookies may impact your experience of the Site and prevent you from using certain services on the Site.

Like many other companies, to conduct its business and provide its products and services, KONE collects personal data of our customers’, potential customers’ and other companies’ representatives with whom we have a business relationship or want to develop one.

KONE may also collect personal data of KONE’s customers’ customers or end-users who contact KONE relating to elevators, escalators or other equipment under KONE maintenance as well as personal data related to external stakeholders KONE is interested to contact and provide with general information of KONE and its business (e.g. media representatives, economic influencers).

This section provides more information about KONE’s personal data processing relating to the abovementioned individuals (collectively referred as ”customers”).

4.1 Collected Personal Data

Following information is collected and processed as needed about customers:

name
title
e-mail
mobile phone number
fixed phone
fax number
address
language
marketing and communication preferences
contract requests and correspondence with our customer service
calls to our customer service or through alarm phone and related call data, incl. phone number, time stamps, data regarding the call process (i.e., caller ID (CLI), call duration, wait time, response time, abandon rate and similar information)
survey responses and results if you have participated in a survey
information related to incidents and claims
Possible other information relevant for the business relationship

Such personal information is later in this Section 4 of the privacy statement referred to as “personal data”.

4.2 The Purposes and Legal Grounds of the Processing

The purpose why KONE processes personal data is to provide products and services, facilitate, manage and develop KONE’s business, support sales activities, manage deliveries, maintenance services and invoicing, contacting customers for contract management and marketing purposes, provide customer service and otherwise maintaining the customer relationship. KONE may also use personal data to handle incidents and claims as well as provide assistance as requested by customer. KONE may also handle personal data for performing customer due diligence for compliance and risk management purposes. KONE may contact the data subjects for conducting surveys, such as customer loyalty surveys.

Processing of the personal data is necessary for the performance of contracts to which the customer company is a party. Further, processing of personal data is necessary for the legitimate interests pursued by KONE relating to its regular business purposes such as marketing, sales management and claims handling, compliance and risk management, and assisting end-users. KONE may also be obliged by applicable local laws to collect certain information. When required by applicable laws, KONE will request your consent for personal data processing.

4.3 Source(s) of Personal Data and Retention Period

The personal data has been received from you as the customer or obtained in connection with the use of KONE’s products and services. Personal data may also originate from KONE’s representatives based on their business interactions with you. In certain cases KONE may collect personal data from public registers and other reliable external sources.

The personal data will be stored as long as needed for i.) the purpose it was collected for (e.g., the duration of the ongoing contract or business relationship); ii.) for compliance with applicable legal obligation or statutory retention period (e.g. under commercial, accounting and tax laws); iii.) statute of limitation for claims; and/or iv.) other justified reason that requires us to keep the data. After your personal data is not needed, the personal data will be effectively deleted or made anonymous.

KONE uses solutions and database technology to manage the data of KONE’s suppliers’ and subcontractors’ representatives and employees (collectively referred as ”suppliers”). In this Section 5, we provide more information about KONE’s personal data processing relating to such sourcing and purchasing activities.

If you are external workforce of KONE, processing of your personal data is explained in a separate privacy statement shared to you.

5.1 Collected Personal Data

Following information is collected and processed as needed about you as a supplier:

name
title
e-mail
phone number
address
invoicing Information
date of birth
residence
possible other information relevant for the business relationship
in case of subcontractors’ employees’: name, date of birth, contact information, employment information, employees’ supervisors’ contact information, trainings, qualifications and certifications, other personal information as required by KONE or KONE’s customers to ensure proper access control and safety for construction sites. KONE may also process incident or accident related information of subcontractors’ employees’.

Such personal information is later in this section 5 privacy statement referred to as “personal data”.

5.2 The Purposes and Legal Ground of the Processing

The purposes why KONE processes supplier personal data is to facilitate KONE’s sourcing, purchasing, invoice handling and contract management activities. KONE may also use the information to resolve claims or manage incidents and perform supplier due diligence for compliance and risk management purposes as well as audits.

KONE may use the contact information for more general communications and management of the supply relationship, such as sending relevant information of KONE’s operations and upcoming events.

KONE processes personal data because it is necessary for the performance of a sourcing contract and/or because it is necessary for the purposes of the legitimate interests pursued by KONE relating to its regular business activities. KONE may also be obliged by applicable local laws to collect certain information about the supplier and its employees and representatives. Such obligations may relate e.g. to safety requirements, taxation, insurances and contractor’s other statutory obligations and liability when work is contracted out. When required by applicable laws, KONE will request data subject’s consent for personal data processing.

5.3 Source(s) of Personal Data and Retention Period

The personal data has been obtained from the suppliers or obtained in connection with their business relationship with KONE. In certain cases KONE may collect personal data from public registers and other reliable external sources.

The personal data will be stored as long as needed for i.) the purpose it was collected for (e.g., the duration of the ongoing contract or business relationship); ii.) for compliance with applicable legal obligation or statutory retention period (e.g. under commercial, accounting and tax laws); iii.) statute of limitation for claims; and/or iv.) other justified reason that requires us to keep the data. After your personal data is not needed, the personal data will be effectively deleted or made anonymous.

We may share your personal data to the following parties to the extent needed in connection with the above described purposes and always to the extent necessary and allowed under applicable laws:

Companies within the KONE group
Authorities in connection with legal proceedings or in order to comply with our compelling legal obligations.
Our subcontractors and service provides that process personal data on our behalf based on our assignment and subject to our instructions. KONE ensures that such service providers are bound by a written data processing agreement that sufficiently addresses data protection and confidentiality requirements. These subcontractors and service providers provides us, for example, website hosting, data analysis, information technology and related infrastructure services as well as marketing, customer service, auditing and other services.
Other entities in connection with mergers and acquisitions
As required or permitted by applicable law
To other third-parties as required or permitted by applicable law or based on your consent, which we may have received in connection with a particular service, for example.

Due to technical and practical requirements, personal data may also be processed outside the EU/EEA. When KONE transfers personal data outside the EU/EEA, KONE ensures that there is a legal basis for such transfers either by means of agreements
(EU Commission’s standard contractual clauses available here) or otherwise (e.g., by an adequacy decision by the European Commission). In addition, we ensure by contract that our subcontractors and service providers transfers your personal data outside the EU/EEA only on KONE’s permission and only when sufficient legal grounds exist.

As a data subject you have certain rights with regards to your personal data.

You may contact KONE and exercise the following rights you have as a data subject:

Right to access: You may request confirmation whether your personal data is processed by KONE and if so, get a copy of the personal data processed about you.
Right to rectify: You may request us to rectify any incomplete, inaccurate or outdated personal data.
Right to be forgotten: You are entitled to ask us to erase personal data related to you in certain circumstances, for example, if you consider them unnecessary for the purposes described above, you withdraw the consent you have given, you consider that KONE’s processing of your personal data is contrary to law, or you object to the use of your personal data for direct marketing purposes.
Right to withdraw consent: If the personal data processing is based on your consent, you are entitled to withdraw your consent at any time.
Right to object: If the personal data processing is based on KONE’s legitimate interest, you may object such processing based on a specific individual circumstance. To exercise this right, you must identify such circumstance in the request relating to objection. You are always entitled to object processing of your personal data for direct marketing purposes.
Right to restrict processing: Under certain circumstances, you have a right to require KONE to restrict the processing of your personal data.
Right to data portability: if we are processing your personal data based on your consent or performance of a contract, you may request to receive your personal data in a structured, commonly used and machine-readable format, and you have the right to request transfer of the personal data to another controller.

If you wish to exercise your rights described above or you have any concerns, remarks or questions regarding KONE’s data processing activities, you may at any time contact KONE through contact information provided under Section 2 above or using the contact form available on the kone.com webpage at https://www.kone.com/en/contact.aspx (select option “Personal Data Enquiry”).

Please note that KONE may refuse a request or obtain a reasonable fee for fulfilling a request if the request is manifestly unfounded or excessive or KONE has another legitimate ground for refusing the request. Such legitimate grounds could e.g. prevent KONE from deleting personal data that needs to be retained due to local legal requirements or to maintain an audit trail until the end of local claim period. KONE may also need to retain the data to be able to fulfil contractual obligations.

Please also note, that if KONE blocks or deletes your personal data as requested, KONE may not be able to perform the services you would like to use or have previously ordered or requested or provide you the content you would like to download or receive.

You have always right to lodge a complaint with the local supervisory authority regarding processing of your personal data. You can find information on competent supervisory authorities in the EU countries as well as their contact information here.

KONE seeks to develop the Site, its business as well as its data protection related processes and tools continuously and reserves the right to amend this Privacy Statement. KONE hopes that you review this Privacy Statement from time to time for any amendments. To the extent required by applicable privacy laws, KONE may contact you also through other interfaces or by using the collected contact information to provide information about updates that have material effects to you as a data subject.