www.caterpillar.com Open in urlscan Pro
23.210.125.118 Public Scan

Back to summary

Submitted URL:
http://caterpillar.com/dataprivacy
Effective URL:
https://www.caterpillar.com/dataprivacy
Submission: On September 27 via manual (September 27th 2024, 7:25:47 am UTC) from US — Scanned from DE

Form analysis
1 forms found in the DOM

Name: search — GET /en/search/search-results.html

<form action="/en/search/search-results.html" class="search-inner search siteSearchForm" id="search" name="search" method="GET">
  <i class="material-icons" id="siteSearchForm_search_icon">search</i>
  <label for="searchInput" class="sr-only">Search</label>
  <input type="search" class="input-large search-input" id="searchInput" name="search" placeholder="What are you looking for?" autocomplete="off" onkeyup="newSearchAutoSuggestHeader(this, 'search');">
  <input type="hidden" name="pagePath" id="pagePath" value="/content/caterpillarDotCom/en/legal-notices/dataprivacy">
  <input type="hidden" id="newSearchEnabled" value="true">
  <input type="submit" class="hidden" value="Search">
  <a href="#" onclick="" class="search-close" role="button" aria-label="close">×</a>
  <div id="searchsearchInputSuggBox" class="suggestionBox col-7 col-lg-10 col-md-8 col-sm-6 col-xs-6" style="display:none">
    <!-- end existing aem autosuggest -->
  </div>
</form>

Text Content

Skip to main content
* Company
Company

--------------------------------------------------------------------------------

* All Company
* Strategy & Purpose
* Governance
* History
* Caterpillar Foundation
* Code of Conduct
* Sustainability
* Diversity & Inclusion
* Innovation
* Political Engagement
* Global Locations
* Visitors Center & Museum
* Working Together

Frequently Asked Questions (FAQs)

Find a list of Frequently Asked Questions (FAQs) about Caterpillar and our
brands. Answers include investor information.

Got questions? Find out how to connect with Caterpillar.

* Brands
Brands

--------------------------------------------------------------------------------

* All Brands
* Cat
* Cat Financial
* Cat Reman
* Cat Rental Store
* Cat Lift Trucks
* Anchor
* AsiaTrak
* FG Wilson
* Hindustan
* MaK
* MWM
* Perkins
* Progress Rail
* SEM
* Solar Turbines
* SPM Oil & Gas
* Turner Powertrain Systems

Caterpillar Merchandise

Cat® hats, boots, shoes, bags, models, phones, watches – and so much more.
Appreciation for the brand extends far beyond those who use our equipment.

Cat® Products & Services

Cat® product offerings include articulated trucks, backhoe loaders, dozers,
engines, excavators, generators, motor graders, skid steer loaders and wheel
loaders.

* Investors
Investors

--------------------------------------------------------------------------------

* All Investors
* Stock Information
* Financial Information
* Shareholder Services
* Events & Presentations
* Quarterly Financial Results
* Caterpillar Reports
* SEC Filings
* Governance

Corporate Press Releases

Read corporate press releases and news announcements distributed by
Caterpillar Inc.

Governance

Our leaders are committed to supporting customers and driving profitable
growth.

* News
News

--------------------------------------------------------------------------------

* All News
* Feature Stories
* Corporate Press Releases
* Media Information
* Social Media
* Frequently Asked Questions (FAQs)
* Caterpillar Publications

Caterpillar Reports

Find the latest Annual, Sustainability, Diversity & Inclusion and Lobbying
Reports.

Industries We Serve

Construction, mining, energy and rail. The industries we serve are essential
in our modern world.

* Careers
Careers

--------------------------------------------------------------------------------

* All Careers
* Working at Caterpillar
* Career Areas
* Diversity & Inclusion
* Meet Team Caterpillar

Search for Jobs

There are big jobs to be done worldwide, and that work is powered by our
people. Join the team.

Contact Us languageEnglish
Select a Language
* English
* Deutsch
* Español
* Français
* Italiano
* Magyar
* Nederlands
* Polski
* Português
* Русский
* 中文
* 日本語

* searchSearch
* language English
* English
* Deutsch
* Español
* Français
* Italiano
* Magyar
* Nederlands
* Polski
* Português
* Русский
* 中文
* 日本語

* Contact Us

search Search ×

OK
* Caterpillar Inc
* Legal Notices
* Caterpillar Global Data Privacy Statement

CATERPILLAR GLOBAL DATA PRIVACY STATEMENT

As stated in Our Values in Action - Caterpillar's Code of Conduct, "We recognize
and respect the personal information privacy interest of individuals.” When you
provide Caterpillar with your personal information, you trust us to protect that
information. Trust is the foundation of the relationships Caterpillar has with
its employees, suppliers, dealers, customers and all others. We collect and
process only personal information needed or appropriate for business purposes,
and do so only by lawful and fair means. This Privacy Statement is meant to help
you understand what personal data we collect, why we collect it, and what we do
with it. We hope you take time to read it carefully.

Caterpillar Global Data Privacy Statement

Effective Date: May 25, 2018

Updated: October 15, 2020

This Privacy Statement describes how Caterpillar collects, stores, uses, and
transfers personal information. This Privacy Statement reflects the values and
principles expressed in Our Values in Action (Caterpillar’s Worldwide Code of
Conduct).

Expand All

SECTION 1. WHAT IS THE SCOPE OF THIS DOCUMENT?

This Privacy Statement applies to the Caterpillar subsidiaries, affiliates, and
other entities controlled by Caterpillar Inc. as are identified in Schedule A
(List of Caterpillar Data Controllers / Legal Entities) (collectively,
“Caterpillar”). This Privacy Statement applies only when Caterpillar is
collecting or otherwise processing personal information for Caterpillar’s
purposes (i.e., when Caterpillar (either alone or in common with other entities)
is a controller and therefore determines the purposes for which and the manner
in which any personal information is processed). This Privacy Statement does not
apply when Caterpillar is collecting or otherwise processing personal
information on behalf of another company, such as Caterpillar’s dealers,
suppliers, and customers.

The applicable Caterpillar entity that is the “controller” of your data is the
one with which you have a relationship, including for example: as a customer
(e.g., the Caterpillar company referred to in your purchase order or other
agreement with Caterpillar), an employee (e.g., the Caterpillar company that you
are attempting to or have entered into a relationship with), or a supplier
(e.g., the Caterpillar company that you are attempting to or have entered into a
supplier relationship with). Caterpillar encourages the periodic review of this
Privacy Statement to stay aware of any changes it.

For convenience, in several sections this Privacy Statement is organized by the
category of data subjects identified below. Please note that in some situations,
you may not fit perfectly into any one category (for example, more than one
could apply, or you might not be a customer of Caterpillar, yet the customer
section is the most applicable). Please review all of the language that is
appropriate to your relationship with Caterpillar. This Privacy Statement covers
the personal information of individuals who are:

* Caterpillar candidates for employment or employees (meaning staff, personnel,
and workers) or other persons currently or formerly employed to perform work
for Caterpillar, including temporary employees (collectively, “employees”);
* Associated with Caterpillar’s customers, including dealers, dealers’
customers, distributors, distributors’ customers, direct sale customers,
sales representatives and other resellers (collectively, “customers”); and
* Associated with suppliers of Caterpillar, such as suppliers’ employees
(temporary workers, staff, personnel, and contractors, etc.) (collectively,
“suppliers”).

In this Privacy Statement, the term “processing” means any activity performed on
personal information, including, for example, collecting, storing, modifying,
transferring or otherwise using it. Additionally, this Privacy Statement does
not apply to other information (non-Personal Information) that Caterpillar may
collect or otherwise process. For more information on other information that
Caterpillar may collect or otherwise process, please see Caterpillar’s Data
Governance Statement.

In addition to this Privacy Statement, some Caterpillar systems, applications,
and processes may contain their own privacy notices, which provide additional
details about what specific personal information is collected and how it is
stored, used, and transferred.

Certain jurisdictions may prohibit or limit the collection, use or sharing of
specific categories of personal information; accordingly, this Privacy Statement
describing our practices may be limited by those laws and/or further clarified
in any country-specific appendices applicable to you and attached to this
Privacy Statement. When in conflict with this Privacy Statement, those
appendices control.

SECTION 2. WHAT IS PERSONAL INFORMATION?

For purposes of this Privacy Statement, personal information is any information
about a specific individual or that identifies or may identify a specific
individual. In other words, it is any piece of information than can be linked to
you. Certain jurisdictions may prohibit or limit the collection of specific
categories of personal information. Subject to local law and any attached
appendices, examples of personal information that we may collect include, but
are not limited to:

* Contact Information (e.g., name, address, telephone number, emergency
contact(s) information);
* Social Security Number or other national/taxpayer identification numbers;
* Identification and Verification Information (e.g., photographs, driver’s
license, passport, other proofs of identity);
* Information Security Data (e.g., communications created, stored or
transmitted by a person using Caterpillar’s information technology or
communications equipment);
* Information to fulfill items such as, but not limited to, communications,
contracts, purchase orders, payments, and receivables; and
* Other information required to comply with applicable laws, including valid
search warrants, subpoenas, or court orders.

Different categories of persons may be subject to additional collection of
personal information, including but not limited to:

Customers:

* Business Contact Information (e.g., company name, address, telephone number);
* Individual Representative Contact Information: (e.g., name, address,
telephone number, email address);
* Billing Information (e.g., financial account data, invoices, receipts);
* Client Relationship Management Information (e.g., information necessary to
populate a customer’s profile or to facilitate marketing automation);
* Repair Information (e.g., repair needs and status);
* Warranty Information (e.g., purchase history, extended warranties); and
* Customer Satisfaction Information.

Caterpillar may receive equipment information that is personally identifiable by
another party, e.g., the equipment owner, but in most instances, Caterpillar
will not be the controller of that information.

Employees:

* Background Information (e.g., birth date, marital status, dependent
information, ethnicity and/or nationality);
* Residency Information (e.g., work permit status);
* Financial Account Information;
* Reference Information (e.g., letters of recommendation or reference, or
reports provided by former employers or colleagues);
* Background Check Information (e.g., credit and criminal background checks,
drug and alcohol testing);
* Health Information (e.g., prescription records, benefit claims, and the
Explanation of Benefits sent in connection with claims);
* Biometric Information (e.g., thumbprints);
* Trade Union affiliation;
* Automotive Information (e.g., driving history, vehicle registration, driver’s
license number);
* Professional Qualifications Information (e.g., work experience, education);
and
* Employment-related Information (e.g., work history, new hire forms, skills,
education and training, performance appraisals, goals, attendance, work
absences, vacation entitlement and requests, compensation history, workplace
injury and illness reporting, disciplinary issues, and grievances).

Suppliers:

* Residency Information (e.g., work permit status);
* Financial Account Information;
* Background Information (e.g. due diligence)
* Professional Qualifications Information (e.g., work experience, education);
* Reference Information (e.g., letters of recommendation or reference, or
reports provided by former employers or colleagues); and
* Biometric Information (e.g., thumbprints).

Depending on the applicable local law, some personal information collected by
Caterpillar may be considered “sensitive personal information” (i.e., personal
information subject to additional protections).

Additionally, in some cases, such as where you are the sole proprietor of a
business, information about your company may be deemed personal information.
This could include business information (e.g., office address), financial
account information (e.g., bank account information, trade references, financial
statements), assets (e.g., property ownership), credit rating, tax
identification, and diversity classification.

Caterpillar may use anonymized (or de-identified information), that was derived
from personal information, but in its anonymized form cannot be identified with
a specific individual. This de-identified information is not considered personal
information for purposes of this Privacy Statement and is not covered by this
Privacy Statement. However, if such information is used or formatted in such a
way that it is possible for that information to be identified with a specific
individual, then it will be considered personal information as appropriate.

SECTION 3. HOW DOES CATERPILLAR COLLECT PERSONAL INFORMATION?

Caterpillar collects personal information in a variety of contexts from
different categories of persons.

Customers (either directly or, in some cases, through third parties) can provide
personal information through the business relationship involved in acquiring,
marketing, or selling Caterpillar products or services. This includes, for
example, submission of personal information as part of a proposal, a contract,
receiving and employing services or products (including repair and warranty
services), and potentially accessing Caterpillar systems or monitoring
Caterpillar processes. Throughout the duration of a customer relationship,
Caterpillar reserves the right to request, as needed, other forms of personal
information necessary to facilitate the purposes described below.

Employees can provide personal information directly during the application and
on-boarding process, throughout the duration of employment, and, in some cases
where permitted, upon separation. In addition, Caterpillar may collect the
information described above from a third party, for example, when we contact
references that were provided to Caterpillar by an employee, or when we obtain
background check information in accordance with our policies and applicable laws
in connection with an employee’s application or on-boarding process. Much of
this information is voluntarily provided to Caterpillar as a condition of
employment to facilitate Caterpillar’s management of the employer-employee
relationship, which is vital to our collective success.

Suppliers can provide personal information through the business relationship
involved in acquiring, marketing, or selling Caterpillar products or services.
This includes, for example, submission of personal information as part of a
proposal, a contract, delivering services or products, and potentially accessing
Caterpillar systems or monitoring Caterpillar processes. Throughout the duration
of a supplier relationship, Caterpillar reserves the right to request, as
needed, other forms of personal information necessary to facilitate the purposes
described below.

Additionally, for individuals who go to a Caterpillar facility or location,
photographs or video may be captured (e.g., closed circuit television cameras or
CCTV).

Caterpillar processes your personal information where it is permitted to do so
under applicable data protection laws, including for the purposes of its
legitimate interests, to comply with a legal obligation of Caterpillar, and
where you have consented for Caterpillar to do so.

In some cases, your consent to the collection of your personal information may
be provided in a manner appropriate to the context, meaning it can be provided
orally, in writing, electronically, or—when permitted by local laws—it may be
implied where the purpose is apparent from the circumstances and you voluntarily
provide your personal information. Subject to local laws, and as may be
articulated in the attached country-specific appendices, there may be
circumstances under which Caterpillar must obtain explicit consent from you.
Such consent is your choice and is entirely voluntary. In some circumstances,
you may withdraw your consent to Caterpillar’s collection and use of personal
information subject to contractual and legal restrictions and reasonable notice.

SECTION 4. HOW DOES CATERPILLAR USE PERSONAL INFORMATION?

Caterpillar uses personal information in ways that are compatible with the
purposes for which the information was originally collected. This may include
use for a purpose that is reasonably related to the original purpose of
collection. Caterpillar collects, uses, and discloses personal information as an
essential part of operations.

Additional information describing how we use this personal information may be
provided in the supplemental appendices that describe unique legal obligations
and rights available in different jurisdictions.

Personal information may also be processed in order to meet legal requirements
applicable to Caterpillar, such as filing with government agencies, complying
with lawful orders to provide information, meeting contractual commitments, and
in connection with Caterpillar safeguarding its rights and property.

Personal information is vital to our management and administration of customer,
employment, and supplier relationships generally. Subject to local law and any
attached appendices, personal information is collected from different categories
of persons for different purposes. Below, we describe the different purposes for
collecting personal information from customers, suppliers, and employees.

Customer Personal Information Collection Purposes

Caterpillar uses customer personal information to conduct business operations
(e.g., satisfy customer orders), market new products through individual outreach
or group communications (e.g., newsletters), assess internal performance, manage
customer relationships, (e.g., invoicing and payments), manage risk and
compliance, and support various administrative functions. Some examples of
personal information Caterpillar may collect from customers and accompanying
uses include:

Examples of Personal Information

Examples of Use

Individual Representative Contact Information (e.g., name, address, telephone
number).

To communicate with representatives of the customers and to manage the
relationship.

Billing Information (e.g., financial account data, invoices, receipts).

To complete customer orders and submit necessary billing information.

Identification and Verification Information (e.g., photographs, driver’s
license, passport, other proofs of identity).

To enable physical or remote access to Caterpillar facilities or systems. (e.g.
authentication)

Information Security / Technology Data (e.g., information captured through the
use of Caterpillar systems).

To facilitate use of the applicable systems and security of those systems.

Image, Video (e.g., CCTV footage) (for individuals who go to a Caterpillar
facility or location)

To facilitate safety and security

Employee Personal Information Collection Purposes

Caterpillar uses employee personal information to conduct business operations
(e.g., managing access control, security systems, and updating personnel
directories), foster employee development (e.g., Training), support various
administrative functions (e.g., administering compensation plans, benefits, and
leave schedules), and manage the operation of our businesses.

Some examples of personal information that Caterpillar may collect from
employees and accompanying uses include:

Examples of Personal Information

Examples of Use

Contact Information of employee and family members (e.g., name, address,
telephone number, emergency contact(s) information).

To communicate with employees and to facilitate benefits.

Professional Qualifications Information (e.g., work experience, education).

To evaluate and select individuals for a role within Caterpillar.

Employment-related Information (e.g., work history, performance appraisals,
goals, attendance, work absences).

To manage the employment relationship.

Employment-related Information (e.g., workplace injury).

To meet compliance obligations and manage safety.

Identification and Verification Information (e.g., photographs, driver’s
license, passport, other proofs of identity).

To meet compliance obligations and to enable physical or remote access to
Caterpillar facilities or systems.

Biometric Information (e.g., thumbprints).

To identify or authenticate users and for access control purposes.

Automotive Information (e.g., vehicle license plate information).

To facilitate access to Caterpillar facilities (e.g., parking).

Information Security / Technology Data (e.g., information captured through the
use of Caterpillar systems).

To facilitate use of the applicable systems and security of those systems.

Image, Video (e.g., CCTV footage)

To facilitate safety and security

Supplier Personal Information Collection Purposes

Caterpillar uses supplier personal information to conduct business operations
(e.g., managing access control and security systems), select and approve new
suppliers, assess supplier performance, manage supplier relationships, (e.g.,
invoicing, and payments), manage risk and compliance, and support various
administrative functions.

Some examples of personal information Caterpillar may collect from suppliers and
accompanying uses include:

Examples of Personal Information

Examples of Use

Contact Information (e.g., name, address, telephone number, emergency contact(s)
information).

Listing in Caterpillar’s internal, enterprise wide directory, which is used to
communicate with representatives of the supplier and to manage the relationship.

Professional Qualifications Information (e.g., work experience, education).

To evaluate and select suppliers.

Identification and Verification Information (e.g., photographs, driver’s
license, passport, other proofs of identity).

To enable physical or remote access to Caterpillar facilities or systems.

Information Security Data (e.g., information captured through the use of
Caterpillar systems).

To facilitate use of the applicable systems and security of those systems.

Image, Video (e.g., CCTV footage) (for visitors)

To facilitate safety and security

SECTIONS 5-7. HOW DOES CATERPILLAR SAFEGUARD, KEEP, AND DISPOSE OF PERSONAL
INFORMATION?

Section 5. How does Caterpillar safeguard personal information?

Caterpillar utilizes reasonable measures, including information technology
security and physical security measures, to protect personal information. These
measures are appropriate to the risks posed by the processing of personal
information and to the sensitivity of the personal information and take into
account the requirements of applicable local law. Caterpillar requires all
persons to abide by applicable security policies related to personal information
when using Caterpillar systems.

Section 6. How long does Caterpillar keep personal information?

Caterpillar stores personal information as needed to accomplish the purposes
identified above and to meet legal requirements, including record retention. Our
retention of your personal information is at all times subject to local law.
This storage period may extend beyond the term of your relationship with
Caterpillar.

Section 7. How does Caterpillar dispose of personal information?

When personal information is no longer useful, or in any event, after legal
authority to retain it has expired, personal information will be destroyed, in
accordance with local law and pursuant to procedures established by the relevant
Caterpillar system or process.

SECTION 8. HOW DOES CATERPILLAR TRANSFER OR SHARE PERSONAL INFORMATION THAT IS
COLLECTED?

Because Caterpillar operates a global business, we may need to transfer your
personal information to different jurisdictions for our business purposes.
Caterpillar may transfer personal information to countries or jurisdictions that
may not legally mandate the same level of data protection as the jurisdiction in
which that personal information was collected. This Privacy Statement applies to
all Caterpillar operations and their data processing activities and Caterpillar
has entered into data transfer agreements with its affiliates worldwide to
protect personal information.

Caterpillar only shares personal information with others in a manner consistent
with this Privacy Statement, for the purposes stated above, when required by
law, or with your consent. Information transfers to third parties will generally
be transfers to third-party processors for those purposes consistent with this
Privacy Statement. In addition, Caterpillar may transfer personal information to
third-party data controllers as required by law, with your consent, or with
approval from a relevant authority. In some jurisdictions, transfer of
specifically delineated categories of data or transfer to certain third parties
may require explicit consent from you. In all instances, the transfer of
personal information is subject to local law and the attached appendices.

When Caterpillar shares personal information with third parties that process the
personal information on Caterpillar’s behalf (e.g., contractors, consultants),
Caterpillar takes reasonable steps to require such recipients to protect
personal information in accordance with applicable laws. Examples of third
parties with whom we may share information for any of these purposes include:

* Vendors, service providers, and other partners who support our business, such
as providing technical infrastructure services;
* Law enforcement or other government agencies (when required by law;
authorized by the customer; to protect Caterpillar, a person or property; and
to support our business, such as in applications for government grants);
* Subsidiaries, affiliates and other entities controlled by Caterpillar;
* Other third-party service providers that process personal information on
behalf of Caterpillar;
* An acquiring entity (or an entity that is interested in acquiring) in the
event that Caterpillar divests (or is considering divesting) a portion of its
business; and
* (Employees only) Vendors providing medical or financial planning services to
employees.

SECTION 9. WHAT ARE YOUR ACCESS RIGHTS REGARDING PERSONAL INFORMATION?

Caterpillar takes steps to maintain the accuracy and completeness of personal
information. You may request and will receive reasonable access to the personal
information you have provided to Caterpillar and have an opportunity to correct
it if necessary. Caterpillar procedures grant you access to your personal
information and enable the exercise of other rights that may be available to you
under applicable local law.

Unless prohibited by local law or, in some cases, as mandated by local law, your
right to access your personal information may be limited. Examples for why your
access may be limited include:

* The request relates to legal advice and proceedings;
* A legal privilege may be claimed regarding the subject matter of the
information;
* The personal information also includes the personal information of a third
party who has not consented to disclosure and whose privacy would be affected
by any such disclosure;
* The request is insufficiently detailed or has already been responded to;
* The request is frivolous or vexatious; or
* (Employees only) The information could disclose a confidential reference.

Caterpillar will consider local laws when reviewing requests to access or alter
personal information held by Caterpillar.

If you are a customer, please contact the person representing Caterpillar to
whom you have given your personal information for the proper procedure for
obtaining access to your personal information.

If you are an employee, please contact your local, regional or corporate Human
Resources representative for the proper procedure for obtaining access to your
personal information. Upon request, and after providing satisfactory proof of
identity and any additional requirements established by applicable local law,
you will be given access to your personal information that you have a right to
review and, if appropriate, the option to copy, modify, delete, or contest that
personal information in Caterpillar’s systems.

If you are a supplier, you may contact the individual at your organization who
is responsible for the Caterpillar relationship and who maintains a Corporate
Web Security Identification (CWS ID) and/or has access to the Supplier Data
Management Application (e.g. Supplier Connect) for “self-service” access.

For more specific information regarding rights under the General Data Protection
Regulations (“GDPR”); please see Appendix 1 and/or Appendix 2 as applicable.
For more specific information regarding rights under the California Consumer
Privacy Act (CCPA); please see Appendix 4 of this document.

SECTIONS 10-11. WHERE CAN YOU OBTAIN FURTHER INFORMATION? WHAT HAPPENS IF THIS
PRIVACY STATEMENT CHANGES?

Section 10. Where can you obtain further information?

If you have any questions about this Privacy Statement, you may contact us by
email at dataprivacy@cat.com; by telephone at +1 309-494-3282 (DATA); or by
mail to the address listed below. If you believe your personal information has
been handled in a manner inconsistent with this Privacy Statement you should not
hesitate to reach out to dataprivacy@cat.com or Caterpillar’s Office of Business
Practices at
https://www.caterpillar.com/en/company/code-of-conduct/office-of-business-practices.html
or by calling +1 (800) 300-7898 or the country specific phone number listed on
the above referenced website.

Attn: Data Privacy Team
Caterpillar Inc.
100 NE Adams St.
Peoria, IL 61629

Additionally, contact information for your local Data Controller may also be
provided in your purchase order or any other agreement you have with
Caterpillar.

If you are an employee, you can receive more information through your local,
regional or corporate Human Resources representative at:

Human Resources, 100 N.E. Adams Street, Peoria, IL 61629, USA
corporate_hr@cat.com

In some cases, contact information for your local Human Resources representative
is included in your Employee Handbook or Agreement.

Section 11. What happens if this Privacy Statement changes?

We reserve the right to amend this Privacy Statement as needed. When we do, the
changes will be communicated to affected persons at that time, and we will note
near the top of this Privacy Statement the date that any such changes are made
and/or when they become effective. In some instances, if the changes we make are
material, we may also send you an e-mail message or other communication telling
you about such changes and any choices you may have or actions you can take
before they go into effect. Depending on the nature of the changes and subject
to local law, your continued relationship with Caterpillar will demonstrate your
acceptance of those changes.

APPENDIX 1. NON-HUMAN RESOURCES DATA SUBJECTS EEA

This Appendix to the Caterpillar Global Data Privacy Statement provides
additional information about how Caterpillar collects, stores, uses, transfers
and otherwise processes personal information (including special categories of
personal information) in or from certain countries in the European Economic Area
(“EEA”). This Appendix is applicable to individuals who do not have an employee
/ human resources relationship with Caterpillar. For more information please see
Caterpillar’s Global Data Privacy Statement. For more information on how
Caterpillar collects and processes non-personal information, please see
Caterpillar’s Global Data Governance Statement.

If you were referred to this EEA Appendix from an agreement you have with
Caterpillar, then the data controller for the personal information that is being
processed in connection with that agreement will be the legal entity referred to
in that agreement. For the purpose of this EEA Appendix, the relevant
controllers are listed in the Schedule A (List of Caterpillar Data Controllers /
Legal Entities) of the Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal
information. This EEA Appendix describes how we collect, store, use, and
transfer personal information about you during and after your relationship with
us, in accordance with the General Data Protection Regulation (“GDPR”). As Data
Controller, we are required under data protection legislation to notify you of
the information contained in this EEA Appendix.

Section 2. What sensitive personal information could Caterpillar collect and
process?

Sensitive personal information (also known as special categories of information)
requires a higher level of protection. This is personal information which
reveals or contains: racial or ethnic origin, political opinions, religious and
philosophical beliefs, trade union membership, genetic data, biometric data,
health data, sex life or sexual orientation.

We may collect, store and use the following, which may include or be considered
“special categories” of information (as defined above):

* Background Information (e.g., marital status, dependent information,
ethnicity and/or nationality, credit and criminal background checks, and drug
and alcohol testing); and
* Biometric Information (e.g., thumbprints).

Section 3. Why does Caterpillar use your personal information?

We need all the categories of information collected primarily to allow us to
manage our relationship with you in order to operate our business and to enable
us to comply with our legal and regulatory obligations. In some cases, we may
use your personal information to pursue legitimate interests of our own or those
of third parties, provided your interests and fundamental rights do not override
those interests.

The reasons for which we, or a contracted third party, will process your
personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several
purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Non-Human Resources
Data

Data Subjects

Categories of Personal Data

Purposes of Processing

Legal Basis for Processing

Customers and Suppliers

* Contact Information (e.g., name, address, telephone number, company name)
* Billing information (financial accounts data, invoices receipt, residence
information)
* Client relationship Management Information
* Electronic identification information (e.g., email), system usage and
preferences

* Facilitate communications
* Evaluation and potentially entering into a business relationship or contract,
including potentially preparing bids (responses to bids) and other requests
that relate to the potential business
* To facilitate financial transactions and management; Audit
* Fulfilling our compliance obligations (e.g., anti-money laundering, screening
against sanctions lists)
* Management of our IT systems and to provide services

* Performance of a contract
* Comply with legal requirements
* Legitimate interest (to manage the relationship)

Customers

* Contact Information (e.g., name, address, telephone number, company name)
* Billing information
* Credit worthiness
* Electronic identification information (e.g., email), system usage and
preferences

* Repair and Warranty Information
* Conducting credit reference checks and financial due diligence
* Performing customer satisfaction survey

* Performance of a contract
* Legitimate interest (to receive feedback on customers experiences)

Visitors to facilities

* Contact Information (e.g., name, address, telephone number, company name)
* Image (photograph, video)

* Prevention and detection of crime or other misconduct
* Other security and risk management purposes

* Comply with legal requirements
* Legitimate interest (safety and security)

Subscribers to our newsletters or other marketing activities

* Contact Information (e.g., name, address, telephone number, company name)
* Electronic identification information (e.g., email) and preferences

* To inform you about our activities, sending you our newsletter, sending you
our reports, share exciting new information about our products

* Legitimate interest (communicating about related products or services)
* Consent

Section 4. What are Caterpillar’s lawful bases for processing your personal
information?

We will only use your personal information when the law allows us to. Most
commonly, we will rely on one or more of the following bases for processing your
personal information:

* Where it is necessary in order to comply with a legal or regulatory
obligation.
* Where it is necessary for our legitimate interests (or those of a third
party) and your interests and fundamental rights do not override those
interests.
* Where it is necessary for the performance of a contract.
* We may also use your personal information in the following situations, which
are likely to be rare:
* Where we need to protect your interests (or someone else’s interests).
* Where it is needed in the public interest or for official purposes.
* Where we have obtained your prior consent (this is only used in relation to
voluntary processing and is not used for processing that is necessary or
obligatory).

The legal grounds we rely on to process your personal information are listed in
Table 1.

Section 5. What are special categories of personal information used for at
Caterpillar?

We will use your special categories of personal information for the following
purposes:

* Information related to biometric data, to identify or authenticate users and
for access control purposes.
* Background check information, to evaluate and select individuals with whom
Caterpillar is working.

We may process special categories of personal information (as defined above)
because we have a lawful basis for doing so (as set out above) and because in
limited circumstances, we have your explicit written consent. Less commonly, we
may process this type of information where it is needed in relation to legal
claims or where it is needed to protect your interests (or someone else’s
interests) and you are not capable of giving your consent, or where you have
already made the information public. We may also process such information in the
course of legitimate business activities with the appropriate safeguards.

Section 6. When is automated decision making used?

Caterpillar does not regularly and systematically perform automated decision
making producing a legal effect concerning individuals or that would have a
similarly significant effect. In the event that you are interacting with a
Caterpillar company that is performing such automated decision making you should
receive a specific notice that outlines the details of the automated decision
making.

Under European data protection laws (and subject to the manner in which they and
other laws and regulations apply to and must be complied with by Caterpillar),
you have the right to object to automated decision making using your personal
information.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow
us to process certain particularly sensitive data. If we do so, we will provide
you with details of the information that we would like and the reason we need
it, so that you can carefully consider whether you wish to consent. We also rely
on consent in other situations as identified in Table 1.

You should be aware that it is not a condition of your contract with us that you
agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to
perform the contract we have entered into with you (such as paying you or
providing you with a product), or we may be prevented from complying with our
legal or regulatory obligations.

Section 9. What if the purpose for which Caterpillar collected the personal
information changes?

We will only use your personal information for the purposes for which we
collected it, unless we reasonably consider that we need to use it for another
reason and that reason is compatible with the original purpose. If we need to
use your personal information for an unrelated purpose, we will notify you and
we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge
or consent, in compliance with the above rules, where this is required or
permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including
third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If
we do, you can expect a similar degree of protection with respect to your
personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third party service providers (including contractors,
designated agents, insurers and insurance brokers) and other entities of
Caterpillar. Examples include:

* Vendors, service providers, and other partners who support our business, such
as providing technical infrastructure services;
* Law enforcement or other government agencies;
* Subsidiaries, affiliates and other entities controlled by Caterpillar;
* Other third-party service providers that process personal information on
behalf of Caterpillar; and
* An acquiring entity (or an entity that is interested in acquiring) in the
event that Caterpillar divests (or is considering divesting) a portion of its
business.

Section 12. When might Caterpillar share your personal information within
Caterpillar?

We will share your personal information within Caterpillar as part of our
regular business and reporting activities, in the context of a business
reorganization or group restructuring exercise, for system maintenance support,
for hosting of data and for other legitimate business reasons.

Section 13. Why might Caterpillar share your personal information with Third
Parties?

We will share your personal information with Third Parties for the following
reasons:

* In order to comply with a legal or regulatory obligation, where such
disclosure is required by a regulatory or supervisory authority, the police
or a court of competent jurisdiction;
* Where it is necessary to administer the contract with or for you;
* For the purposes of auditing, insuring and in the course of seeking advice
with regards to our business operations and claims handling; and
* Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the
EU?

The personal information that we collect about you may be transferred to, and
stored at, one or more countries outside the European Economic Area (“EEA”). It
may also be processed by staff operating outside the EEA who work for
Caterpillar or for our third-party service providers. In such cases, we will
take appropriate steps to ensure an adequate level of data protection of the
recipient as required under the GDPR and as described in this document. If we
cannot ensure such an adequate level of data protection, your personal data will
only be transferred outside the EEA if you have given your prior consent to the
transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place appropriate security measures to protect the security of
your personal information and provide the appropriate level of security for the
risk, including measures designed to prevent your personal information from
being accidentally lost, used or accessed in an unauthorized way, altered, or
disclosed. Details of those measures are available on request. In addition, we
limit access to your personal information to those employees, agents,
contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach
and will notify you and any applicable regulator of a suspected breach where we
are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to
fulfill the purposes for which it was collected, including for the purposes of
satisfying any legal, regulatory, accounting, or reporting requirements. Details
of retention periods for different aspects of your personal information are
available in our data retention policy. To determine the appropriate retention
period for personal information, we consider the amount, nature, and sensitivity
of the personal information, the potential risk of harm from unauthorized use or
disclosure of your personal information, the purposes for which we process your
personal data and whether we can achieve those purposes through other means, and
the applicable legal requirements.

Section 17. What is your duty to inform Caterpillar of changes to your personal
information?

It is important that the personal information we hold about you is accurate and
current. Please contact your Caterpillar contact or email dataprivacy@cat.com
for informing us of any necessary changes to your personal information that we
possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

* Request access to your personal information (commonly known as a “data
subject access request”). This enables you to receive a copy of the personal
information we hold about you and to check that we are lawfully processing
it.
* Request correction of the personal information that we hold about you. This
enables you to have any incomplete or inaccurate personal information we hold
about you corrected.
* Request erasure of your personal information. This enables you to ask us to
delete or remove personal information where there is no good reason for us
continuing to process it. You also have the right to ask us to delete or
remove your personal information where you have exercised your right to
object to processing (see below).
* Object to processing of your personal information where we are relying on a
legitimate interest (or those of a third party) and there is something about
your particular situation which makes you want to object to processing on
this ground. You also have the right to object where we are processing your
personal information for direct marketing purposes.
* Request the restriction of processing of your personal information. This
enables you to ask us to suspend the processing of personal information about
you, for example if you want us to establish its accuracy or the reason for
processing it.
* Request the transfer of your personal information to another party.
* Lodge a complaint with the applicable supervisory authority with regard to
our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using
one of the following methods:

Online: EU Individual Rights Request Form
Email: dataprivacy@cat.com
Telephone: +1 (800) 806-6832 or +1 309-494-3282(DATA)

You will not have to pay a fee to access your personal information (or to
exercise any of the other rights). However, we may charge a reasonable fee if
your request for access is clearly unfounded or excessive. Alternatively, we may
refuse to comply with the request in such circumstances.

Section 19. What might Caterpillar need from you?

We may need to request specific information from you to help us confirm your
identity and ensure your right to access the personal information (or to
exercise any of your other rights). This is another appropriate security measure
to ensure that personal information is not disclosed to any person who has no
right to receive it.

Section 20. What is your right to withdraw consent?

In the circumstances where you may have provided your consent to the collection,
processing and transfer of your personal information for a specific purpose, you
have the right to withdraw your consent for that specific processing at any
time. To withdraw your consent, please contact dataprivacy@cat.com or use any
unsubscribe options we may provide you in the context of our processing
activities. Once we have received notification that you have withdrawn your
consent, we will no longer process your personal information for the purpose or
purposes you originally agreed to, and unless we have another lawful basis for
continuing to process your personal information, we will dispose of it securely.

Section 21. What if there are changes to this document?

We reserve the right to update this Global Privacy Statement and this appendix
at any time, and we will provide you with updated documents when we make any
substantial updates. We may also notify you in other ways from time to time
about the processing of your personal information.

[END Appendix 1. Non-Human Resources Data Subjects EEA]

APPENDIX 2. HUMAN RESOURCES DATA SUBJECTS EEA

This Appendix to the Caterpillar Global Data Privacy Statement provides
additional information about how Caterpillar collects, stores, uses, transfers
and otherwise processes personal information (including special categories of
personal information) in or from certain countries in the European Economic Area
(“EEA”). This Appendix is applicable to individuals who have an employee / human
resources relationship with Caterpillar. For more information, please see
Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Section 2. What sensitive personal information could Caterpillar collect and
process?

We may collect, store and use the following, which may include or be considered
“special categories” of information (as defined above):

* Health Information (e.g., prescription records, benefit claims, and the
Explanation of Benefits sent in connection with claims) related to, among
other things, physical or mental health, disability status, sickness absence,
and family related leaves;
* Background Information (e.g., marital status, dependent information,
ethnicity and/or nationality, credit and criminal background checks, and drug
and alcohol testing);
* Biometric Information (e.g., thumbprints); and
* Trade Union affiliation.

Section 3. Why does Caterpillar use your personal information?

Personal information is vital to our management and administration of employment
relationships. We need all the categories of personal information collected
primarily to allow us to manage our relationship with you and to enable us to
comply with our legal and regulatory obligations. In some cases, we may use your
personal information to pursue legitimate interests of our own or those of third
parties, provided your interests and fundamental rights do not override those
interests.

The reasons for which we, or a contracted third party, will process your
personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several
purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Human Resources
Data

Categories of Personal Data

Purposes of Processing

Legal Basis for Processing

Contact Information (e.g., name, address, telephone number, emergency contact(s)
information)

* Communicate with employees
* Facilitate benefits
* Maintain accountability of business records

* Performance of a contract
* Legitimate interest (to manage and communicate with the workforce)

Identification and verification information (including national/taxpayer
identification numbers and work permit status)

* Meet compliance obligations
* Enable physical or remote access to Caterpillar facilities or systems
* Communicate with employees
* Facilitate benefits

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage and communicate with the workforce)

Financial Account Information

* Communicate with employees
* Facilitate salary and benefits

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage and communicate with the workforce)

Automotive Information (e.g., driving history, vehicle registration, driver’s
license number)

* Facilitate access to Caterpillar facilities (e.g., parking)
* Manage company vehicles

* Performance of a contract
* Legitimate interest (to facilitate access and management of Caterpillar
facilities and equipment)

Professional/Applicant Qualifications Information (e.g., work experience,
education, reference information)

* Evaluate and select individuals for a role within Caterpillar

* Legitimate interest (to manage the workforce)

General HR records

* Management purposes
* Verification purposes, necessary as evidence in the event of any
query/dispute and for the provision of references
* Conduct analytics studies to review and better understand employee retention
and attrition rates
* Managing education, training and development

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage the workforce)

Employment-related Information (e.g., work history, performance appraisals,
goals, attendance, work absences)

* Monitoring and evaluation of performance to support decisions (e.g., salary
increases, incentives and promotion)

* Legitimate interest (to manage the workforce)

Health & Safety (e.g., safety incidents)

* Manage health and safety at facilities

* To comply with a legal obligation
* To protect the vital interests
* Legitimate interest (to maintain safety)

Personal data obtained from security, monitoring, or an investigation

* Prevention and detection of crime or other misconduct
* Other security and risk management purposes

* To comply with a legal obligation
* To protect the vital interests
* Legitimate interest (to manage the workforce and security)

Personal data processed on our IT systems

* For the conduct of the business

* Performance of a contract
* Legitimate interest (to manage business processes and systems)

Section 4. What are Caterpillar’s lawful bases for processing your personal
information?

We will only use your personal information when the law allows us to. Most
commonly, we will rely on one or more of the following bases for processing your
personal information:

* Where it is necessary for the performance of a contract we have entered into
with you.
* Where it is necessary in order to comply with a legal or regulatory
obligation.
* Where it is necessary for our legitimate interests (or those of a third
party) and your interests and fundamental rights do not override those
interests.

We may also use your personal information in the following situations, which are
likely to be rare:

* Where we need to protect your interests (or someone else’s interests).
* Where it is needed in the public interest or for official purposes.
* Where we have obtained your prior consent (this is only used in relation to
voluntary processing and is not used for processing that is necessary or
obligatory).

We will rely on legitimate interests as the lawful basis for processing the
categories of personal information set out below and, in each case we have
identified the legitimate interest upon which we rely. (We also identify
supplemental bases for processing certain categories of information where
warranted.)

Section 5. What are special categories of personal information used for at
Caterpillar?

We will use your special categories of personal information for the following
purposes:

* Information relating to leaves of absence, which may include sickness absence
or family related leaves, to comply with employment and other laws.
* Information about your physical or mental health, or disability status, to
ensure your health and safety in the workplace and to assess your fitness to
work, to provide appropriate workplace adjustments, to monitor and manage
sickness absence and to administer benefits.
* Information related to trade union affiliation to facilitate dues collection,
maintain contact lists, and perform other business-related activities.
* Information related to ethnicity and/or nationality, to comply with
employment and other laws.
* Information related to biometric data, to identify or authenticate users and
for access control purposes.
* Information related to employment-related background checks, to evaluate and
select individuals for a role within Caterpillar.

We may process special categories of personal information (as defined above)
because we have a lawful basis for doing so (as set out above) and because:

* In limited circumstances, we have your explicit written consent;
* We need to carry out obligations or exercise specific rights in the field of
employment and social security law and in line with our Global Data Privacy
Statement;
* Where it is needed in the public interest, such as for equal opportunities
monitoring and in line with our Global Data Privacy Statement; or
* Where it is needed to assess your working capacity on health grounds, subject
to appropriate confidentiality safeguards.

Less commonly, we may process this type of information where it is needed in
relation to legal claims or where it is needed to protect your interests (or
someone else’s interests) and you are not capable of giving your consent, or
where you have already made the information public. We may also process such
information in the course of legitimate business activities with the appropriate
safeguards.

Section 6. When is automated decision making used?

Section 7. Does Caterpillar need your consent?

You should be aware that it is not a condition of your contract with us that you
agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

If you fail to provide certain information when requested, we may not be able to
perform the contract we have entered into with you (such as paying you or
providing a benefit), or we may be prevented from complying with our legal or
regulatory obligations (such as ensuring your health and safety).

Section 9. What if the purpose for which Caterpillar collected the personal
information changes?

Please note that we may process your personal information without your knowledge
or consent, in compliance with the above rules, where this is required or
permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including
third-party service providers and Caterpillar.

We may transfer your personal information outside the European Union (“EU”). If
we do, you can expect a similar degree of protection with respect to your
personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third-party service providers (including contractors,
designated agents, insurers and insurance brokers) and other entities of
Caterpillar. Examples include:

* Vendors, service providers, and other partners who support our business, such
as providing technical infrastructure services;
* Law enforcement or other government agencies;
* Subsidiaries, affiliates and other entities controlled by Caterpillar;
* Other third-party service providers that process personal information on
behalf of Caterpillar; and
* An acquiring entity (or an entity that is interested in acquiring) in the
event that Caterpillar divests (or is considering divesting) a portion of its
business.

Section 12. When might Caterpillar share your personal information within
Caterpillar?

* payroll;
* benefits provision and administration (including pensions);
* occupational health or medical assessments regarding your fitness to work and
health and safety (e.g. workstation assessments);
* insurance claims and notifications;
* provision and administration of recruitment assessments, training and
professional development;
* library and research services such as subscriptions and memberships;
* building security access and maintenance;
* travel providers;
* telecommunications and messaging services such as our business continuity
emergency notification system;
* hard copy archiving; and
* IT services.

Section 13. Why might Caterpillar share your personal information with Third
Parties?

We will share your personal information with Third Parties for the following
reasons:

* In order to comply with a legal or regulatory obligation, where such
disclosure is required by a regulatory or supervisory authority, the police
or a court of competent jurisdiction;
* Where it is necessary to administer the contract, working relationship and
any associated benefits with or for you;
* For the purposes of auditing, insuring and in the course of seeking advice
with regards to our business operations and claims handling; and
* Where we have another legitimate interest in doing so.

Section 14. When would Caterpillar transfer personal information outside of the
EU?

Section 15. What security measures are in place to protect personal information?

We have put in place procedures to deal with any suspected data security breach
and will notify you and any applicable regulator of a suspected breach where we
are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

We will only retain your personal information for as long as necessary to
fulfill the purposes for which it was collected, including for the purposes of
satisfying any legal, regulatory, accounting, or reporting requirements. Details
of retention periods for different aspects of your personal information are
available in our data retention policy which is available from the HR
department. To determine the appropriate retention period for personal
information, we consider the amount, nature, and sensitivity of the personal
information, the potential risk of harm from unauthorized use or disclosure of
your personal information, the purposes for which we process your personal data
and whether we can achieve those purposes through other means, and the
applicable legal requirements.

Once you are no longer an employee, worker or contractor of Caterpillar, we will
retain and securely destroy your personal information in accordance with our
data retention policy.

Section 17. What is your duty to inform Caterpillar of changes to your personal
information?

It is important that the personal information we hold about you is accurate and
current. Please contact your Human Resources representative for the proper
procedure for informing us of any necessary changes to your personal information
that we possess.

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

If you want to exercise your right(s) as reflected above, you may do so by using
one of the following methods:

Online: EU Individual Rights Request Form
Email: dataprivacy@cat.com
Telephone: +1 (800) 806-6832 or +1 309-494-3282(DATA)

Section 19. What might Caterpillar need from you?

Section 20. What is your right to withdraw consent?

In the limited circumstances where you may have provided your consent to the
collection, processing and transfer of your personal information for a specific
purpose, you have the right to withdraw your consent for that specific
processing at any time. To withdraw your consent, please your local, regional or
corporate Human Resources representative. Once we have received notification
that you have withdrawn your consent, we will no longer process your personal
information for the purpose or purposes you originally agreed to, and unless we
have another lawful basis for continuing to process your personal information,
we will dispose of it securely.

Section 21. What if there are changes to this document?

[END Appendix 2. Human Resources Data Subjects EEA]

APPENDIX 3. AUSTRALIA

Updated 07/01/2019

This Appendix to the Caterpillar Global Data Privacy Statement provides
additional information about how Caterpillar collects, stores, uses, transfers
and otherwise processes personal information in or from Australia. For more
information, please see the main body of Caterpillar’s Global Data Privacy
Statement.

Section 1. Storage of Personal Information

Caterpillar stores personal information electronically on our servers, which are
provided and managed by Caterpillar and its third-party vendors.

Section 2. Cross-border Transfers of Personal Information

We may disclose personal information outside of Australia, including to
Caterpillar affiliates that are covered by this Global Data Privacy Statement
and to vendors used by those Caterpillar companies (for a list of Caterpillar
affiliates covered by Caterpillar’s Global Data Privacy Statement and the
country in which they are established, see the Legal Entities Section of the
Global Data Privacy Statement). The countries in which overseas recipients are
likely to be located currently include the United States of America, the United
Kingdom, the Netherlands, Switzerland, Singapore, China, Japan, and India. For
personal information that is subject to the Australian Privacy Principles, we
take appropriate steps to ensure an appropriate level of protection (e.g.,
consistent with the Australian Privacy Principles) when transferring such
personal information to those in other countries or obtain your consent.

Section 3. Contacting Caterpillar or the Office of the Australian Information
Commissioner

If you have any questions about Caterpillar’s processing of your personal
information, please contact your local Caterpillar contact, Caterpillar’s Data
Privacy Office at dataprivacy@cat.com, or Caterpillar’s Office of Business
Practices as listed in Section 10 of the Global Data Privacy Statement. If you
believe that personal information has been handled in a manner inconsistent with
the Global Data Privacy Statement and you are not satisfied with the response
provided by your local Caterpillar contact, the Privacy Office or Caterpillar’s
Office of Business Practices you may wish to contact the Office of the
Australian Information Commissioner.

APPENDIX 4. CALIFORNIA

Effective: January 1, 2020 (Last updated: January 1, 2023)

Pursuant to the California Consumer Privacy Act ("CCPA") and the California
Privacy Rights Act ("CPRA") (collectively, "California Privacy Law") this
Appendix to the Caterpillar Global Data Privacy Statement provides additional
information about how Caterpillar collects, stores, uses, transfers and
otherwise processes personal information about California consumers (as defined
by the CCPA). This Appendix applies only to California consumers. For the
purpose of this Appendix, a “California consumer” is a natural person who
resides in California. Please refer to Article 1 – Human Resources Consumers of
this Appendix 4 for more information in the Human Resources context. Please
refer to Article 2 – Non-Human Resource Consumers of this Appendix 4 for more
information about other consumers. For more information about Caterpillar’s
practices about personal information more generally, please see the main body of
Caterpillar’s Global Data Privacy Statement.

Article 1 – Human Resources Consumers

Section 1. What is the Purpose of this Article to Appendix 4?

The purpose of this Article to Appendix 4 is to inform job applicants, employees
of, owners of, directors of, officers of, medical staff of, and contractors of
Caterpillar (collectively referred to as "employees" for the purposes of this
Article), of the categories of Personal Information (as defined below) that we
collect and the purposes for which we use such Personal Information.

Section 2. Collection and Use of Personal Information for Business Purposes

For purposes of this Appendix, “Personal Information” is information that
relates to an identified or identifiable person. Personal Information does not
include deidentified, aggregated, or combined information, which includes data
that is not reasonably capable of identifying you or being linked to you.
Personal Information also does not include publicly available information
(information that is lawfully made available from federal, state, or local
government records).

We collect, use, and disclose employee Personal Information for business
purposes only (as described further below) and in a manner consistent with
applicable laws. Where we disclose Personal Information to third parties, we do
so for the same purposes described below and, where appropriate, we require that
such third parties maintain the confidentiality of the Personal Information and
maintain appropriate systems and processes to secure and protect the Personal
Information.

We collect and use the following categories of Personal Information about you to
manage your employment relationship with us:

Category of Personal Information

Sources of Information

Business or Commercial Purpose for which the Personal Information was
Collected/Used

Categories of Third Parties to Whom the Personal Information is Disclosed

Identifiers (e.g., name, personal and work address, personal and work telephone
number, personal and work e-mail address, emergency contact(s) information)

* Directly from individuals (e.g., from employees, on behalf of dependents,
from supervisors, about employees);
* Third Parties (e.g., references from former employers, companies with which
employees have interacted to facilitate their employment with Caterpillar or
procure benefits associated with their employment).

To identify and communicate and to manage and maintain benefits and company
records

* Vendors, service providers, and other partners who support our business, such
as providing technical infrastructure services
* Subsidiaries, affiliates, and other entities controlled by Caterpillar
* Other third-party service providers that process Personal Information on
behalf of Caterpillar

To facilitate access to Caterpillar facilities (e.g., parking)

Professional or employment related information (e.g., work experience,
education, references, certifications, professional memberships, languages
capabilities, work history, performance appraisals, disciplinary, conduct
records, goals, attendance, workplace injury, fitness for duty, and any other
similar information provided through the application process or during
employment)

To evaluate and select individuals for role(s) within Caterpillar and facilitate
development

To meet compliance obligations, determine eligibility for work, and to enable
physical or remote access to Caterpillar facilities or systems

To meet compliance obligations and manage health and safety

To manage payroll, benefits, and expenses

To manage business travel, including without limitation logistics,
reimbursement/payment, and safety

Education information (e.g., educational background, internal and external
training, professional certifications, experience, and other background
information used for screenings)

To manage the employment relationship and manage compliance obligations

Audio, electronic, visual or similar information (e.g., images in connection
with use of company systems, such as voicemail or CCTV footage or access control
systems)

To facilitate access to Caterpillar facilities

To facilitate the use of the applicable systems and security of those systems

Internet and other electronic network activity information (e.g., communication
information and computer usage information related to company equipment or
devices, and information captured using Caterpillar systems, including any
information that you create or upload into those systems)

To monitor and ensure compliance with applicable laws, regulatory requirements,
and applicable corporate procedures by monitoring the use of company technology
resource systems, databases, and property and conducting investigations

To manage corporate information technology tools, devices and networks,
including helpdesk, corporate directory, IT support, and IT security.

Characteristics of protected classes (if provided voluntarily) (e.g., racial or
ethnic origin, gender, citizenship/residency status, religious beliefs, and
veteran or military status)

To identify and communicate and to manage and maintain benefits and company
records

To ensure compliance with applicable laws, regulatory requirements, and
applicable Caterpillar procedures

Inferences drawn from the information collected (e.g., those related to
abilities and performance)

To administer the workforce and employment related activities (e.g., talent and
team management, workforce analysis)

Sensitive Personal Information, as defined under the CPRA, requires a higher
level of protection. The categories of Sensitive Personal Information we may
collect and use include the following:

* Social Security, Driver’s License, State Identification Card, or Passport
Number;
* Account and Password Data (where such log-in information is in combination
with any required security or access code, password, or credentials allowing
access to an account)
* Health Information (e.g., prescription records, benefit claims, and the
Explanation of Benefits sent in connection with claims);
* Background Information (e.g., marital status, dependent information,
ethnicity and/or racial origin, credit and criminal background checks, and
drug and alcohol testing);
* Communications Data (e.g., the content of electronic messages)
* Biometric Information (e.g., thumbprints); and
* Trade Union affiliation.

The business purposes for which we may collect and use Sensitive Personal
Information include the following:

* Administering and providing compensation and benefits, including
administering and providing payroll, bonus, incentives, equity compensation,
and reporting of the same, where applicable or required;
* Managing the workforce, including managing work activities, attendance, and
workforce analysis;
* Managing and enabling workforce registrations and access to IT systems
including applications and websites used for the performance of work
operations and performance evaluations;
* Employee and visitor safety and health/wellbeing and facilitating access to
our premises;
* Communications with you, other Company employees, and/or third parties (such
as existing or potential business partners, suppliers, customers,
end-customers, future employers, quasi-governmental officials or government
officials) and facilitating the use of the applicable systems to enable such
communications;

We may also use and disclose the categories of Personal Information identified
above to:

* To audit interactions, transactions, and records;
* To monitor compliance with company policies and procedures, including
investigations of non-compliance;
* To detect security incidents, protecting against malicious, deceptive,
fraudulent, or illegal activity, and prosecuting those responsible for that
activity;
* To comply with legal obligations and to disclose to law enforcement or other
government agencies (when required by law; to protect Caterpillar, a person
or property; to support our business, such as in applications for government
grants; and when authorized by you); and
* Otherwise disclose in accordance with directions, or consent, from you.

We have not sold your Personal Information in the preceding twelve (12) months
and will not sell your Personal Information to third parties. We do not engage
in providing financial incentives in exchange Personal Information.

Section 3. What Rights Are Available to You

California Privacy law grants you certain rights with regard to your Personal
Information; however, these rights are not absolute and in certain circumstances
do not apply.

The rights include:

* Right to Request Know / Access to Your Personal Information – The right to
request information about the collection of your Personal Information by
Caterpillar or access your Personal Information.
* Right to Deletion – The right to request the deletion of Personal Information
about you.
* Right to Opt-Out of Sale or Sharing of Personal Information – The right to
direct the business to not sell or share (or stop selling or sharing) your
Personal Information.
* Right to Correct Inaccurate Personal Information – The right to direct the
business to correct inaccurate Personal Information held about you.
* Right to Limit the Use and Disclosure of Sensitive Personal Information – The
right to limit the business’ use and disclosure of Sensitive Personal
Information (as defined in the CPRA), to that which is necessary to perform
the services or provide the goods reasonably expected by an average consumer
who requests such goods or services, or for the performance of certain
enumerated business purposes.
* Right to Opt-Out of Automated Decision-Making Technology – The right to
object to automated decision making using your Personal Information.
* Right of No Retaliation – The right to not be retaliated against for
exercising your rights under California Privacy Law.
We will not discriminate or retaliate against you for exercising any of your
rights under California Privacy Law, and unless permitted by California
Privacy Law, we will not:
* deny you goods or services;
* charge you different prices or rates for goods or services, including
through granting discounts or other benefits, or imposing penalties;
* provide you a different level or quality of goods or services; or
* suggest that you may receive a different price or rate for goods or
services or a different level or quality of goods or services;

for exercising one of your rights under the California Privacy Law.

Section 4. How to invoke your California Privacy Rights?

You may exercise your right(s) under the CCPA and by using one of the following
methods:

* Online: California Rights Request Intake Form;
* Email: dataprivacy@cat.com; or
* Telephone: +1 (800) 806-6832 or +1 309-494-3282(DATA).

Since we can only respond to a verified request, we may request information from
you in order to confirm that you, or an authorized agent designated by you, are
the one exercising your right as a consumer. We may request that you send your
request through your account (if you have an account) or we may ask certain
security questions to verify your identity before we respond to your request.
You do not need to create an account with Caterpillar to exercise any of your
individual rights (access, deletion, or opt-out of sale).

You have the right to designate an Authorized Agent. To the extent that you
elect to designate an authorized agent to make a request on your behalf, they
must provide appropriate documentation including written signed permission from
you, proof of your identity, and verification of their identity; or a valid,
designated power of attorney as defined under the California Probate Code.

Section 5. Who can I Contact for Additional Information?

You can email Caterpillar’s Data Privacy team at: dataprivacy@Cat.com or through
postal service at:

Attn: Data Privacy
Caterpillar Inc.
100 N.E. Adams Street
Peoria, IL 61629

Article 2 – Non-Human Resource Consumers

Section 1. What is the Purpose of this Article to Appendix 4?

California Privacy Law provides California consumers with certain rights
regarding Personal Information about them. This Article describes how we
collect, process, and disclose Personal Information about you during and after
your relationship with us and explains your rights. If you are a California
consumer and would like to exercise any of those rights under California Privacy
Law, please see Section 5 below for more information on how to submit a
request.

Section 2. What Categories of Personal Information Could Caterpillar Collect,
Process, and Disclose and for what Purposes?

Categories of Personal Information

Sources of Information

Business or Commercial Purpose for which Personal Information was Collected/Used

Categories of Third Parties to Whom the Personal Information is Disclosed

Identifiers (e.g., name, postal address, unique personal identifiers, online
identifiers, IP address, email address)

* Directly from individuals;
* Third parties (e.g., companies with which you interacted to purchase the
Caterpillar product, technology platforms)

* Identify you and manage our relationship with you, including communicate with
you, enable access to Caterpillar facilities and systems, deliver
products/services and related information to you, meet compliance
obligations, and manage safety.
* Auditing related to a current interaction with the consumer and concurrent
transactions
* Detecting security incidents, protecting against malicious, deceptive,
fraudulent, or illegal activity, and prosecuting those responsible for that
activity
* Performing services, including maintaining or servicing accounts, providing
customer service, processing or fulfilling orders or transactions, verifying
customer information, processing payments, providing financing, providing
advertising or marketing services, providing analytic services, or similar
services
* Undertaking internal research for technological development and
demonstration;
* Undertaking activities to verify or maintain the quality or safety of a
service or device that is owned, manufactured, manufacturer for, or
controlled by the business, and to improve, upgrade, or enhance the service
of device that is owned, manufactured, manufactured for, or controlled by the
business
* Debugging to identify and repair errors that impair existing intended
functionality

Personal information categories listed in the California Customer Records
statute (e.g., name, signature, address, telephone number)

Commercial Information (e.g., purchasing history)

Internet or other electronic network activity information (e.g., system and
network identification and credentials and usage)

In the previous 12 months, we have sold (as defined in California law) the
following categories of Personal Information to third parties, subject to your
settings and preferences and your Right to Opt-Out: Identifiers.

To opt out of the selling or sharing of your Personal Information, please click
here.

The categories of third parties to whom we sell or disclose your Personal
Information, and the corresponding business purpose for the selling or
disclosure include: Service providers and advertising partners, for purposes of
providing marketing, personalization, and advertising services.

Sensitive Personal Information, as defined under the CPRA, requires a higher
level of protection. The categories of Sensitive Personal Information we may
collect and use for non-HR consumers include the following:

In addition to the purposes identified above, the business purposes for which we
may collect and use Sensitive Personal Information include the following:

* Information related to biometric data, to identify or authenticate users and
for access control purposes;
* To enable access to IT systems;
* To provide you with the requested goods or services and facilitate
transactions with you;
* Background check information, to evaluate and select individuals with whom
Caterpillar is working.

We may also use and disclose the categories of Personal Information identified
above to:

Section 4. What Rights Are Available to California Consumers?

You may have rights under the CCPA and CPRA. The CCPA and CPRA grant consumers
certain rights with regard to Personal Information that relates to them;
however, these rights are not absolute and in certain circumstances do not
apply. The rights include:

* Right to Request Know / Access to Your Personal Information – The right to
request information about the collection of your personal information by
Caterpillar or access your Personal Information.
* Right to Deletion – The right to request the deletion of Personal Information
about you.
* Right to Opt-Out of Sale or Sharing of Personal Information – The right to
direct the business to not sell or share (or stop selling or sharing) your
Personal Information.
* Right to Correct Inaccurate Personal Information – The right to direct the
business to correct inaccurate Personal Information held about you.
* Right to Limit the Use and Disclosure of Sensitive Personal Information - The
right to limit the business’ use and disclosure of Sensitive Personal
Information (as defined in the CPRA), to that which is necessary to perform
the services or provide the goods reasonably expected by an average consumer
who requests such goods or services, or for the performance of certain
enumerated business purposes.
* Right to Opt-Out of Automated Decision-Making Technology -
* Right of No Retaliation – The right to not be retaliated against for
exercising your rights under the CCPA and CPRA.

We will not discriminate or retaliate against you for exercising any of your
rights under California Privacy Law, and unless permitted by California
Privacy Law, we will not:
* deny you goods or services;
* charge you different prices or rates for goods or services, including
through granting discounts or other benefits, or imposing penalties;
* provide you a different level or quality of goods or services; or
* suggest that you may receive a different price or rate for goods or
services or a different level or quality of goods or services;

for exercising one of your rights under California Privacy Law.

Section 5. How Can California Consumers Invoke their Privacy Rights?

You may exercise your right(s) under the CCPA by using one of the following
methods:

* Online: California Rights Request Intake Form;
* Email: dataprivacy@cat.com; or
* Telephone: +1 (800) 806-6832 or +1 309-494-3282(DATA).

Section 6. Who can I Contact for Additional Information?

You can email Caterpillar’s Data Privacy team at: dataprivacy@Cat.com or through
postal service at:

Attn: Data Privacy
Caterpillar Inc.
100 N.E. Adams Street
Peoria, IL 61629

[END Appendix 4. California]

APPENDIX 5. BRAZIL - NON-HUMAN RESOURCES DATA SUBJECTS

This Appendix to the Caterpillar Global Data Privacy Statement provides
additional information about how Caterpillar collects, stores, uses, transfers,
and otherwise processes personal information (including sensitive personal data)
in or from Brazil. This Appendix is applicable to individuals who do not have an
employee / human resources relationship with Caterpillar. For more information,
please see Caterpillar’s Global Data Privacy Statement. For more information on
how Caterpillar collects and processes non-personal information, please see
Caterpillar’s Global Data Governance Statement.

If you were referred to this Brazil Appendix from an agreement you have with
Caterpillar, then the data controller for the personal information that is being
processed in connection with that agreement will be the legal entity referred to
in that agreement. For the purpose of this Brazil Appendix, the relevant
controllers are listed in the Schedule A - List of Caterpillar Data Controllers
/ Legal Entities of the Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Caterpillar is committed to protecting the privacy and security of your personal
information. This Brazil Appendix describes how we collect, store, use, and
transfer personal information about you during and after your relationship with
us, in accordance with the Brazilian General Data Protection Law (Law No.
13,709/18 - “LGPD”). As Data Controller, we are required under data protection
legislation to notify you of the information contained in this Brazil Appendix.

Section 2. What sensitive personal data could Caterpillar collect and process?

Sensitive personal data requires a higher level of protection. This is personal
information which reveals or contains: racial or ethnic origin, political
opinions, religious and philosophical beliefs, trade union membership, genetic
data, biometric data, health data, sex life or sexual orientation.

We may collect, store, and use the following, which may include or be considered
sensitive personal data (as defined above):

* Background Information, if and when permitted by applicable laws (e.g.,
ethnicity and drug and alcohol testing); and
* Biometric Information (e.g., thumbprints).

Section 3. Why does Caterpillar use your personal information?

The reasons for which we, or a contracted third party, will process your
personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several
purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Non-Human Resources
Data

Data Subjects

Categories of Personal Data

Purposes of Processing

Legal Basis for Processing

Customers and Suppliers

· Contact Information (e.g., name, address, telephone number, company
name)

· Billing information (financial accounts data, invoices receipt,
residence information)

· Client relationship Management Information

· Electronic identification information (e.g., email), system usage and
preferences

· Facilitate communications

· Evaluation and potentially entering into a business relationship or
contract, including potentially preparing bids (responses to bids) and other
requests that relate to the potential business

· To facilitate financial transactions and management; Audit

· Fulfilling our compliance obligations (e.g., anti-money laundering,
screening against sanctions lists)

· Management of our IT systems and to provide services

· Performance of a contract

· Comply with legal requirements

· Legitimate interest (to manage the relationship)

Customers

· Contact Information (e.g., name, address, telephone number, company
name)

· Billing information

· Credit worthiness

· Electronic identification information (e.g., email), system usage and
preferences

· Repair and Warranty Information

· Conducting credit reference checks and financial due diligence

· Performing customer satisfaction survey

· Performance of a contract

· Legitimate interest (to receive feedback on customers experiences)

· Protection of credit

Visitors to facilities

· Contact Information (e.g., name, address, telephone number, company
name)

· Image (photograph, video)

· Vehicle Information (e.g., make, model, license plate)

· Identification Information (e.g., government documents/identifiers)

· Prevention and detection of crime or other misconduct

· Other security and risk management purposes

· Comply with legal requirements

· Legitimate interest (safety and security)

Subscribers to our newsletters or other marketing activities

· Contact Information (e.g., name, address, telephone number, company
name)

· Electronic identification information (e.g., email) and preferences

· To inform you about our activities, sending you our newsletter,
sending you our reports, share exciting new information about our products

· Legitimate interest (communicating about related products or services)

· Consent

Section 4. What are Caterpillar’s lawful bases for processing your personal
information?

We will only use your personal information when the law allows us to. Most
commonly, we will rely on one or more of the following bases for processing your
personal information:

* Where it is necessary to comply with a legal or regulatory obligation.
* Where it is necessary for our legitimate interests (or those of a third
party) and your interests and fundamental rights do not override those
interests.
* Where it is necessary for the performance of a contract.

We may also use your personal information in the following situations, which are
likely to be rare:

* Where we need to protect your life or physical integrity (or someone else’s
life or physical integrity).
* Where we need it for credit protection.
* Where it is necessary for the exercise of our rights in lawsuits,
administrative proceedings, or arbitration.
* Where we have obtained your prior consent (this is only used in relation to
voluntary processing and is not used for processing that is necessary or
obligatory).
* For the protection of credit, including as provided for in relevant
legislation.

The legal grounds we rely on to process your personal information are listed in
Table 1.

Section 5. What are sensitive personal data used for at Caterpillar?

We will use your sensitive personal data for the following purposes:

* Information related to biometric data, to identify or authenticate users and
for access control purposes.

We may process sensitive personal data (as defined above) because we have a
lawful basis for doing so (including, without limitation, for compliance with a
legal obligation, or to protect the security of the data subject, as set out
above) and because in limited circumstances, we have your explicit written
consent. Less commonly, we may process this type of information where it is
needed in relation to legal claims or exercise of our rights, or where it is
needed to protect your life or physical integrity (or someone else’s life or
physical integrity).

Section 6. When is automated decision making used?

Under LGPD, you have the right to request the review decisions taken solely on
the basis of automated processing of personal data that affects your interests.

Section 7. Does Caterpillar need your consent?

In limited circumstances, we may approach you for your written consent to allow
us to process certain particularly sensitive personal data. If we do so, we will
provide you with details of the information that we would like and the reason we
need it, so that you can carefully consider whether you wish to consent. We also
rely on consent in other situations as identified in Table 1.

You should be aware that it is not a condition of your contract with us that you
agree to any request for consent from us. If you give us your consent, you will
be able to withdraw your consent at any time.

Section 8. What if you fail to provide your personal information?

Section 9. What if the purpose for which Caterpillar collected the personal
information changes?

Please note that we may process your personal information without your knowledge
or consent, in compliance with the above rules, where this is required or
permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including
third-party service providers and Caterpillar.

We may transfer your personal information outside Brazil. If we do, you can
expect a similar degree of protection with respect to your personal information.

Section 11. Which Third Parties may process your personal information?

“Third Parties” includes third party service providers (including contractors,
designated agents, insurers and insurance brokers) and other entities of
Caterpillar. Examples include:

* Vendors, service providers, and other partners who support our business, such
as providing technical infrastructure services;
* Law enforcement or other government agencies;
* Subsidiaries, affiliates, and other entities controlled by Caterpillar;
* Other third-party service providers that process personal information on
behalf of Caterpillar; and
* An acquiring entity (or an entity that is interested in acquiring) in the
event that Caterpillar divests (or is considering divesting) a portion of its
business.

Section 12. When might Caterpillar share your personal information within
Caterpillar?

Section 13. Why might Caterpillar share your personal information with Third
Parties?

We will share your personal information with Third Parties for the following
reasons:

Section 14. When would Caterpillar transfer personal information outside of
Brazil?

The personal information that we collect about you may be transferred to, and
stored at, one or more countries outside Brazil. It may also be processed by
staff operating outside Brazil who work for Caterpillar or for our third-party
service providers. In such cases, we will take appropriate steps to ensure an
adequate level of data protection of the recipient as required under LGPD and as
described in this document. If we cannot ensure such an adequate level of data
protection, your personal data will only be transferred outside Brazil if you
have given your prior consent to the transfer.

Section 15. What security measures are in place to protect personal information?

We have put in place procedures to deal with any suspected data security breach
and will notify you and any applicable regulator of a suspected breach where we
are legally required to do so.

Section 16. How long will Caterpillar retain personal information?

Section 17. What is your duty to inform Caterpillar of changes to your personal
information?

Section 18. What are your rights related to your personal information?

Under certain circumstances, by law you have the right to:

* Confirm the existence of processing;
* Request access to your personal information (commonly known as a “data
subject access request”), by means of a summary report or a detailed report.
Under certain limited circumstances, you may be entitled to receive a copy of
the personal information we hold about you.
* Request correction of incomplete, inaccurate, or outdated personal
information we hold about you.
* Request the anonymization, blocking or deletion of unnecessary or excessive
personal information about you, or personal information about you we process
in noncompliance with the provisions of LGPD.
* Request the portability of the personal information we hold about you to
another service or product provider, under specific circumstances.
* Request the deletion of your personal information that was processed based on
your consent.
* Obtain information about public and private entities with which we have
shared your personal information.
* Obtain information about the possibility of denying consent and the
consequences of such denial, whenever we ask for your consent to process your
personal information.
* Oppose to any data processing activity for which your consent was not
required, if there is a breach of LGPD.
* Revoke your consent, whenever our processing of your personal information was
based on your consent.
* Lodge a complaint with the applicable supervisory authority with regard to
our processing of your personal information.

If you want to exercise your right(s) as reflected above, you may do so by using
one of the following methods:

Online: Brazil Individual Rights Request Form

Email: dataprivacy@cat.com

You will not have to pay a fee to access your personal information (or to
exercise any of the other rights). However, we may refuse to comply with the
request if your request for access is clearly unfounded or excessive.

You may also contact the applicable Data Protection Officer. To identify the
Data Protection Officer for the applicable Caterpillar company, please see
Schedule A - List of Caterpillar Data Controllers / Legal Entities.

Section 19. What might Caterpillar need from you?

Section 20. What is your right to withdraw consent?

Section 21. What if there are changes to this document?

[END Appendix 5. Brazil - Non-Human Resources Data Subjects]

APPENDIX 6. BRAZIL - HUMAN RESOURCES DATA SUBJECTS

This Appendix to the Caterpillar Global Data Privacy Statement provides
additional information about how Caterpillar collects, stores, uses, transfers,
and otherwise processes personal information (including sensitive personal data)
in or from Brazil. This Appendix is applicable to individuals who have an
employee / human resources relationship with Caterpillar. For more information,
please see Caterpillar’s Global Privacy Statement.

If you were referred to this Brazil Appendix from an agreement you have with
Caterpillar, then the data controller for the personal information that is being
processed in connection with that agreement will be the legal entity referred to
in that agreement. For the purpose of this Brazil Appendix, the relevant
controllers are listed in the Schedule A (List of Caterpillar Data Controllers /
Legal Entities) to Caterpillar’s Global Privacy Statement.

Section 1. What is the purpose of this appendix?

Section 2. What sensitive personal data could Caterpillar collect and process?

Sensitive personal data (also known as special categories of information)
requires a higher level of protection. This is personal information which
reveals or contains: racial or ethnic origin, political opinions, religious and
philosophical beliefs, trade union membership, genetic data, biometric data,
health data, sex life or sexual orientation.

We may collect, store, and use the following, which may include or be considered
sensitive personal data (as defined above):

* Health Information (e.g., prescription records, benefit claims, and the
Explanation of Benefits sent in connection with claims) related to, among
other things, physical or mental health, disability status, sickness absence,
and family related leaves;
* Background Information, if and when permitted by applicable laws (e.g.,
marital status, race, ethnicity, and drug and alcohol testing);
* Biometric Information (e.g., thumbprints); and
* Trade Union affiliation.

Section 3. Why does Caterpillar use your personal information?

The reasons for which we, or a contracted third party, will process your
personal information are listed in Table 1 below.

Some of those purposes for processing will overlap and there may be several
purposes which justify our use of your personal information.

Table 1. Categories, Purpose, and Legal Bases of Processing: Human Resources
Data

Categories of Personal Data

Purposes of Processing

Legal Basis for Processing

Contact Information (e.g., name, address, telephone number, emergency contact(s)
information)

* Communicate with employees
* Facilitate benefits
* Maintain accountability of business records

* Performance of a contract
* Legitimate interest (to manage and communicate with the workforce)

Identification and verification information (including national/taxpayer
identification numbers and work permit status)

* Meet compliance and legal obligations
* Enable physical or remote access to Caterpillar facilities or systems
* Communicate with employees
* Facilitate benefits

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage and communicate with the workforce)

Financial Account Information

* Communicate with employees
* Facilitate salary and benefits

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage and communicate with the workforce)

Automotive Information (e.g., driving history, vehicle registration, driver’s
license number)

* Facilitate access to Caterpillar facilities (e.g., parking)
* Manage company vehicles

* Performance of a contract
* Legitimate interest (to facilitate access and management of Caterpillar
facilities and equipment)

Professional/Applicant Qualifications Information (e.g., work experience,
education, reference information, background/criminal check)

* Evaluate and select individuals for a role within Caterpillar

* Performance of a Contract
* Legitimate interest (to manage the workforce)

General HR records

* Performance of a contract
* To comply with a legal obligation
* Legitimate interest (to manage the workforce)

Employment-related Information (e.g., work history, performance appraisals,
goals, attendance, work absences)

* Monitoring and evaluation of performance to support decisions (e.g., salary
increases, incentives and promotion)

* Performance of a Contract
* Legitimate interest (to manage the workforce)

Health & Safety (e.g., safety incidents)

* Manage health and safety at facilities

* To comply with a legal obligation
* To protect the life and physical integrity
* Legitimate interest (to maintain safety)

Personal data obtained from security, monitoring, or an investigation

* Prevention and detection of crime or other misconduct
* Other security and risk management purposes

* To comply with a legal obligation
* To protect the life and physical integrity
* Legitimate interest (to manage the workforce and security)

Personal data processed on our IT systems

* For the conduct of the business

* Performance of a contract
* Legitimate interest (to manage business processes and systems)

Section 4. What are Caterpillar’s lawful bases for processing your personal
information?

We will only use your personal information when the law allows us to. Most
commonly, we will rely on one or more of the following bases for processing your
personal information:

* Where it is necessary for the performance of a contract we have entered into
with you.
* Where it is necessary to comply with a legal or regulatory obligation.
* Where it is necessary for our legitimate interests (or those of a third
party) and your interests and fundamental rights do not override those
interests.

We may also use your personal information in the following situations, which are
likely to be rare:

* Where we need to protect your life or physical integrity (or someone else’s
life or physical integrity).
* Where it is necessary for the exercise of our rights in lawsuits,
administrative proceedings or arbitration
* Where we have obtained your prior consent (this is only used in relation to
voluntary processing and is not used for processing that is necessary or
obligatory).
* For the protection of credit, including as provided for in relevant
legislation.

We will rely on legitimate interests as the lawful basis for processing the
categories of personal information set out below and, in each case we have
identified the legitimate interest upon which we rely. We also identify
supplemental bases for processing certain categories of information where
warranted in a specific notice that we will provide you.

Section 5. What are sensitive personal data used for at Caterpillar?

We will use your sensitive personal data for the following purposes:

We may process sensitive personal data (as defined above) because we have a
lawful basis for doing so (as set out above) and because:

Less commonly, we may process this type of information where it is needed in
relation to legal claims or exercise of our rights, or where it is needed to
protect your life or physical integrity (or someone else’s life or physical
integrity).

Section 6. When is automated decision making used?

Under LGPD, you have the right to request the review of automated decision taken
solely on the basis of automated processing of personal data that affects your
interests.

Section 7. Does Caterpillar need your consent?

You should be aware that it is not a condition of your contract with us that you
agree to any request for consent from us.

Section 8. What if you fail to provide your personal information?

Section 9. What if the purpose for which Caterpillar collected the personal
information changes?

Please note that we may process your personal information without your knowledge
or consent, in compliance with the above rules, where this is required or
permitted by law.

Section 10. Will Caterpillar share your personal information?

We may have to share your data with Third Parties (as defined below), including
third-party service providers, other Caterpillar entities, and public government
agencies or authorities.