Topcon Positioning Group Privacy Statement

Your privacy and trust are important to us and this Privacy Statement (“Statement”) provides important information about how Topcon (“Topcon”, “we” or “us”) handles personal information. This Statement describes which personal data we collect through our websites, applications, products, software, or service that links to such websites, applications, products and/or software as well as through our sales and marketing activities (collectively, our “Services”) and the purpose why we collect and process (“collect” or “process”) your personal information.
The subject of data protection is personal data (hereinafter “personal data” or “personal information”), which is all information relating to an identified or identifiable natural person; this includes, for example, names or identification numbers.

Topcon is committed to complying with applicable privacy regulations (“Applicable Laws”) and we have adopted the requirements of these Applicable Laws in our practices regarding the management of personal data in our daily business. Applicable Laws include, but are not limited to, Europe’s General Data Protection Regulation (“GDPR”) as well as Australia’s Federal Privacy Act 1988, the Australian Privacy Principles (“APP”), the California Consumer Privacy Act (“CCPA”) the UK Data Protection Act 2018 (“UK DPA”) and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and substantially similar applicable provincial legislation in Canada.

Please read this Statement carefully and contact our Data Protection Officer (dpo@topcon.com) if you have any questions about our privacy practices or your personal information choices. Additional information is also available at the Topcon Privacy Center at https://www.topconpositioning.com

It is important that you check back often for updates to this Statement. A current version of this Statement is always accessible on our website.

This Statement was last updated on December 9, 2020.

1. What Information about You is Collected by Topcon?

Topcon may request and/or collect certain personal information from you whenever you interact with us, make use of a Service, when you enter personal information on our website or provide us with personal information in any other way including your name, address, email address, telephone number, etc., as well as information related to customer satisfaction surveys, customer purchasing habits, warranty information and/or other purchasing information or other information volunteered by you. Topcon may also collect other technical information such as your IP address, MAC address, internet service provider, computer operating platform, web browser, geolocation and other similar information. We also collect personal data such as name, surname, e-mail and phone number of the relevant contact person of your company. If you work as an individual, we will also collect payment information such as bank information and Tax ID/VAT number. Topcon limits the collection of personal information to that which is necessary for the purposes identified by it at or prior to the time at which such information is collected.You are under no obligation to provide any personal information to Topcon. However, the information Topcon learns from customers helps us personalize and improve the experience at Topcon's websites. If you don't provide such information, some features of Topcon's websites may not be available to you.

Where your information obtained by us will be subject to the APP, you may be entitled to use a pseudonym when interacting with our Services. We also collect personal information from third parties such as our partners, service providers, and publicly available websites, to offer Services we think may be of interest and to help us maintain data accuracy and provide and enhance the Services.

We do not knowingly collect or use personal information from children under the age of 13, and we will not do so in the future without first obtaining verifiable consent from a parent or legal guardian. Should a child whom we know to be under the age of 13 send individual identifying information to us, we will only use that information to respond directly to the child, seeking parental consent or to provide parental notice.

2. Name and Contact Details

Topcon Positioning Systems Inc., a California corporation (7400 National Drive, Livermore, CA 94550 United States), its affiliates (including Topcon America Corporation) and controlled joint ventures (see company locations on https://www.topconpositioning.com/) are the controller(s) of your personal data. Your location and your relationship with the Topcon group will be key to identify the relevant Topcon entities acting as controller or processor of your personal information.

3. How Does Topcon Handle Your Personal Data?

1. Topcon collects, obtains, uses and provides personal information in an appropriate manner.
2. Topcon makes best efforts to ensure personal data to be precise and up-to-date.
3. Topcon takes necessary and appropriate measures to manage personal data including protecting personal data against unauthorized access, loss, leak and damage.
4. Topcon complies with its obligations under the Applicable Laws by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorized access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. In determining data retention periods, Topcon takes into consideration local laws, contractual obligations, and the expectations and requirements of our customers
5. Topcon complies with laws, regulations and the guidelines for them as well as internal rules on personal information.
6. When contracting the handling of personal data to a third party, Topcon only entrusts to a contractor who meets the requirements based on Topcon’s internal rules. Topcon manages such contractors in an appropriate manner.
7. Topcon remains up to date towards any change of the Applicable Laws.

4. What is the Purpose and Legal Basis of Processing Personal Information?

We collect, use, disclose, transfer, and store personal information when needed to provide our Services and for our operational and business purposes as described in this Statement.

Topcon ensures that, in the process of providing its products and services, it will obtain only personal data necessary to carry out its business through the Topcon business entities for the purposes of use (as described below).

Topcon may process your personal information for the following purposes and legal basis:

5. Cookies and Analytics

5.1. Cookies

We store so-called "cookies" in order to offer you a comprehensive range of functions and to make the use of our websites more convenient. "Cookies" are small files that are stored on your computer with the help of your internet browser. If you do not wish the use of "cookies", you can prevent the storage of "cookies" on your computer by making the appropriate settings in your internet browser. Please note that this may limit the functionality and range of functions of our offer.

In particular, we use the following cookies:

Google Analytics - to monitor and analyze traffic coming to the site and page visits while on the site

MixPanel - to anonymously analyze visitor interactions with the site for site troubleshooting and design
improvement

Pardot - to record user submitted contact information for the purposes of fulfilling requested product
information, dealer follow-ups, and trial software requests

These cookies cannot identify you as a person. In any case, the use of cookies is justified on the basis of our legitimate interest in a demand-oriented design and the statistical evaluation of our website and the fact that your legitimate interests do not outweigh Art 6 para. 1 lit. f) GDPR.

5.2. Google Analytics

We use Google Tag Manager, web analysis services of Google Inc. ("Google"). Google uses "cookies", which are text files placed on your device, to help the website analyze your use of https://www.topconpositioning.com/ . We also use MixPanel (upgraded version of Google Analytics) to record the site actions of end-users who have created logins on our support site, https://www.topconpositioning.com/support.

The information generated by the cookie about your use of our Site (including your shortened IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information to evaluate your use of our websites, to compile reports on website activity for website operators and to provide other services associated with the use of our Site and services related to the use of the internet. Google may also transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google.

For more information about how Google uses your information, please see Google's Privacy Policy:

https://www.google.com/policies/privacy/

You can disable Google Analytics by using a browser add-on if you do not want the website analysis. You can download the browser add-on here: http://tools.google.com/dlpage/gaoptout?hl=en .You can object to the use of Google Analytics.

Google Analytics is used on the basis of our legitimate interest in a demand-oriented design, statistical evaluation and efficient advertising of our Site and the fact that your legitimate interests do not outweigh, Art 6 para. 1 f) GDPR.

6. Processing of Sensitive Personal Data

We do not process any sensitive personal data (e.g. health or religious data) from you unless we have previously received for your written consent or as otherwise permitted or required by Applicable Law.

7. Sharing Your Personal Data

Your personal data will be shared, or will likely be shared, within the following entities:

• Our Group of Companies and we have made sure that the entire Topcon Group respect the Applicable Laws, in so far as they are relevant, and only share your personal information within the Topcon Group if this is legitimate, e.g. because there are necessary intra-group agreements in place or because it serves internal administrative purposes in which case we will weigh up your conflicting interests in accordance with the Applicable Laws.
• Third party service providers which have been thoroughly selected based on their compliance with the Applicable Laws, in so far as they are relevant and only when to fulfil the services they provide to us, such as software, system, and platform support; direct marketing services; cloud hosting services; advertising; data analytics; and order fulfillment and delivery. Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us. We will enter into the necessary legal agreements with the third-party service providers in order to secure your personal information.
• Business Partners - Topcon may share personal information with business partners in order to improve your experience with Topcon and for Topcon's marketing purposes. Topcon may share non-personal aggregate data about sales, customers, visitors to the site and related site information with third parties. We will enter into the necessary legal agreements with our business partners in order to secure your personal information.

We do not sell your personal information to or with any other third parties.

9. GDPR, UK DPA and APP Specific Terms

Your Rights and Your Personal Data under GDPR, UK DOA and APP The GDPR, UK DPA and APP afford you certain rights in respect of your personal data. There are differences in respect of the GDPR, UK DPA and APP, however, generally, you have the following rights with respect to your personal data.

To assert one of the below rights please contact us under the relevant contact address stated in clause 2.

Right of access

You have the right to request from us access to the processed personal data concerning you to the extent of Art 15 GDPR, UK DPA and the APP at any time.

Right to rectification of incorrect data

You have the right to request from us the immediate rectification of the personal data concerning you, if these are incorrect.

Right to erasure

Under the requirements set out in Art 17 GDPR and the UK DPA you have the right to request from us the erasure of the personal data concerning you. These requirements especially provide a right to erasure where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, the personal data have been unlawfully processed, you object to the processing or the personal data has to be erased for compliance with a legal obligation in the EU or Member State law to which the we are subject. Regarding the period for which the personal data will be stored please refer to No. 13 of this data protection Statement.

Right to restriction of processing

You have the right to request us to restrict the processing according to Art 18 GDPR and the UK DPA. This right especially exists when the accuracy of the personal data is contested between the user and us, for a period enabling us to verify the accuracy of the personal data, in the case that the data subject who has a right to erasure opposes the erasure of the personal data and requests the restriction of their use instead, for the case that we no longer need the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims as well as if the successful exercise of an objection between us and the user is still controversial.

Right to data portability

You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format according to Art 20 GDPR and the UK DPA.

Right to object

Pursuant to Art 21 GDPR and the UK DPA, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on lit e) or f) of Art 6 para. 1 GDPR. We will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You also have the right to lodge a complaint with the responsible supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR and the UK DPA.

A list of all European data protection authorities can be found here:
http://ec.europa.eu/justice/article29/structure/data-protection-authorities/index_en.htm.

For the UK, complaints can be made at the ICO - https://ico.org.uk/make-a-complaint/

• To the extent the APP applies to your personal information collected by Topcon:
  You may contact Topcon at any time if you have any questions or concerns about this Statement or about the way in which your personal information has been handled.
• You may make a complaint about privacy to the relevant privacy officer (see clause 2).
• The privacy officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. We will generally respond to your complaint within a week.
• If your complaint requires more detailed consideration or investigation, we will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.
• In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.
• If you are not satisfied with our response to your complaint, or you consider that Topcon may have breached the APP, the UK DPA or GDPR, and you have the right to make a complaint to the relevant data protection authority.
• Contact information for the Office of the Australian Information Commissioner can be found here:
  https://www.oaic.gov.au/

10. Canadian Specific Terms (residents of Canada only)

Opt-in consent to receive electronic messages

We may, with your express opt-in consent, send you information about products or services that may be of interest to you, including information on current activities, general announcements, upcoming products and services, changes to our products or services, and upcoming events. These communications may be sent in various ways, including by e-mail, by text message by another form of electronic message and through the Services. If you choose to sign up to receive information about products or services that may be of interest to you, we will collect and use your contact information, including your email address, for this purpose.

You may withdraw your consent to this use of your personal information by contacting us at dpo@topcon.com.

You may also opt out of receiving commercial electronic messages to your electronic address by using the unsubscribe mechanism that will be included in each electronic message we send you. Even if you opt-out of receiving marketing communications, we may send certain service communications, such as confirmations or security announcements, by e-mail, through the Services, or by text message or by another form of communications.
If you send an e-mail to us, or provide us feedback through the Services, we will collect your e-mail address and the full content of your e-mail, including attached files, and other information you provide. We may also use and display your full name and email address when you send an email notification to a friend through the Services (such as in an invitation).

Additional Protection of Personal Information

The only employees who are granted access to your Personal Information are those with a business ‘need-to-know’ or whose duties reasonably require such information.

Right of access and correction of Personal Information

To the extent provided by PIPEDA and substantially similar provincial Applicable Laws, you have the right to request from us access to and the correction of Personal Data concerning you. To initiate the request process please send an email to dpo@topcon.com indicating that you wish to make a request.

We may request that you provide sufficient identification to permit access to the existence, use or disclosure of your Personal Information or any correction thereto. Any such identifying information shall be used only for this purpose. We will attempt to respond to each of your written requests not later than thirty (30) days after receipt of such requests. We will advise you in writing if we cannot meet your requests within this time limit. A reasonable administration fee may be charged to supply the information. The approximate cost of the administration fee will be communicated to the individual prior to releasing the information.

Cross-border transfers of Personal Information

Please note that we may transfer information, including Personal Information, to a jurisdiction that does not have the same data protection laws as Canada, as further outlined in Section 12 below. Such information may become accessible to courts, law enforcement and national authorities in the jurisdiction(s) where it is stored. If you do not want your information to be transferred or stored outside Canada, you should not provide us with any Personal Information.

11. Cross-border Personal Data Transfer and Storage of Your Personal Data

Topcon is a global organization, and your personal information may be, or is likely to be, stored and processed outside of your home country. We take steps to ensure that the information we collect is processed according to this Statement and the requirements of applicable law wherever the data is located. Regardless of location, Topcon handles personal data as described in this Statement.

Topcon has networks, databases, servers, systems, support, and help desks located throughout our offices around the world. We collaborate with third parties such as cloud hosting services, suppliers, and technology support located around the world to serve the needs of our business, workforce, and customers. We take appropriate steps to ensure that personal information is processed, secured, and transferred according to applicable law. In some cases, we may need to disclose or transfer your personal information within Topcon or to third parties in areas outside of your home country. The areas in which these recipients are located will vary from time to time, but may include the United States of America, Canada, Japan, Netherlands, Germany, Belgium, France, Spain, Italy, the United Kingdom, Ireland, Portugal, Australia and other countries where Topcon has a presence or uses contractors.

When we transfer personal information from the European Economic Area or Canada to other countries in which applicable laws do not offer the same level of data privacy protection as in your home country, we take measures to provide an appropriate level of data privacy protection. In other words, your rights and protections remain with your personal information. For example, we use approved contractual clauses, multiparty data transfer agreements, intragroup agreements, and other measures designed to ensure that the recipients of your personal information protect it. If you would like to know more about our data transfer practices, please contact our Data Protection Officer.

12. How Long Do We Keep Your Personal Information?

We erase or make your personal information anonymous as soon as they are no longer required for the purposes for which we have collected or used them in accordance with this Statement. As a rule, we store your personal data for the duration of the usage or contractual relationship plus a reasonable period of time in which we keep backups after deletion.

13. Security and Safety Measures

Topcon takes data security seriously, and we use appropriate technologies and procedures to protect personal information. Our information security policies and procedures are closely aligned with widely accepted international standards and are reviewed regularly and updated as necessary to meet our business needs, changes in technology, and regulatory requirements.

14. Links to Other Websites

Topcon's websites may contain links to other websites. These third-party websites have their own privacy policies, including cookies, and we encourage you to review them. They will govern the use of personal information that you submit, or which is collected by cookies whilst visiting these websites. This Statement does not apply to third party websites and any personal data you provide to third party websites is at your own risk.

15. Consent/ Acknowledgment

By using or supplying personal information through a Topcon website, you signify your agreement and/or your acknowledgment to the terms and conditions of this Statement. If you do not agree to these terms and conditions, please do not disclose any personal information through a Topcon website.